fgt-cve-2023-27997-exploit

FortiGate SSL‑VPN CVE‑2023‑27997 Exploit PoC Script with ROP Chain

Table of Contents

• Description
• Affected Versions
• Installation
• Usage
• Example Output
• Technical Details
• Warnings
• References

Description

fgt-cve-2023-27997-exploit.py is a Proof‑of‑Concept (PoC) exploit script written for the critical vulnerability CVE‑2023‑27997 discovered in Fortinet FortiGate devices.
The vulnerability stems from a heap-based buffer overflow that allows remote code execution (RCE) without authentication on the FortiOS SSL‑VPN interface.

Script workflow:

1. Retrieves the salt value from the target device.
2. Generates a custom ROP (Return‑Oriented Programming) chain.
3. Sends a manipulated GET request to the /remote/hostcheck_validate endpoint, triggering a memory overflow.
4. After the overflow, the prepared ROP chain is executed to run remote commands.

Warning: This script should only be used in authorized testing or laboratory environments.

Affected Versions

Installation

1. Set up a Python 3.7+ environment.
2. Install the required dependencies:

pip3 install -r requirements.txt

requirements.txt content:

root@kitploit:~

requests
urllib3

Usage

python3 fgt-cve-2023-27997-exploit.py <TARGET_IP> <TARGET_PORT>

Example:

python3 fgt-cve-2023-27997-exploit.py 192.168.1.200 10443

Example Output

[*] Launching FortiOS 7.0.5 CVE-2023-27997 ROP Chain Ping Exploit...
[+] Salt retrieved: 749a2b77
[+] Enc parameter generated (1024 characters)
[!] 500 Internal Server Error - Possible memory overflow or crash!

Technical Details

/remote/info   --> salt value retrieved
/remote/hostcheck_validate?enc=<payload> --> buffer overflow triggered

Warnings

• The script should only be run in authorized environments.
• Unauthorized use is illegal and the target device can crash.
• FortiOS 7.0.5 versions use TLS 1.0; the script includes the appropriate TLS setting.

References

• Lexfo Security Blog – XORtigate: CVE‑2023‑27997
• Bishop Fox – Building an Exploit for CVE‑2023‑27997
• Fortinet PSIRT Advisory FG‑IR‑23‑097