CVE-2023-27997 Vulnerability

The vulnerability resides in the way the SSL-VPN portal processes specific HTTP parameters, particularly within the /remote/hostcheck_validate and /remote/logincheck endpoints.

The root cause is a heap-based buffer overflow triggered by an incorrect length check when decoding the enc parameter. The application allocates a buffer based on the input size but fails to validate the payload length correctly due to a truncation error where the length is stored in an 8-bit variable instead of a larger type.

An attacker can exploit this by crafting a request with a payload length that appears valid to the truncated check but actually exceeds the allocated buffer size. This allows the attacker to write data out-of-bounds on the heap. By manipulating the heap layout—often using techniques involving "heap smashing"—attackers can overwrite critical memory structures (such as function pointers or SSL structures) to hijack the execution flow and gain control of the device.

Tactics, Techniques & Procedures (TTPs)

Attackers exploit CVE-2023-27997 primarily for Initial Access and Defense Evasion.

• Reconnaissance: Threat actors scan the internet for FortiGate devices returning the Server: xxxxxxxx-xxxxx header or specific SSL certificate details to identify vulnerable firmware versions.

• Exploitation: They send malicious HTTP GET or POST requests containing crafted enc parameters to the SSL-VPN interface.

• Persistence: Once code execution is achieved, attackers often download lightweight binaries (like BusyBox) to open an interactive shell, allowing them to install webshells, steal configuration files, or move laterally into the internal network.

Indicators of compromise

Detecting this exploit can be challenging because the traffic is encrypted within the SSL-VPN tunnel, but several indicators exist:

• System Crashes: Failed exploit attempts often cause the SSL-VPN process or the entire device to crash and reboot. Frequent, unexplained system restarts are a strong indicator.

• Suspicious HTTP Requests: Look for requests to /remote/hostcheck_validate or /remote/logincheck with unusually long or malformed enc parameters in web logs.

• Unknown Binaries: The presence of unrecognized files or binaries in the /tmp or other temporary directories on the appliance.

• Log Anomalies: Review logs for "application crashed" events or unexpected administrative login sessions originating from the device itself.

Known proof-of-concepts & exploits

Proof-of-Concept (PoC) exploits are widely available and have been verified by multiple security firms.

Security researchers at Bishop Fox and WatchTowr developed fully functional exploits shortly after disclosure, demonstrating the ability to smash the heap and open a reverse shell on vulnerable devices. Exploitation campaigns have been observed in the wild, often targeting unpatched edge devices to deploy ransomware or conduct espionage.