CVE-2022-42475
CRITICAL KEV RANSOMWARE NUCLEIFortiOS 5.0.0-5.0.13 and FortiProxy 1.0.0-1.0.6 - Heap-Based Buffer Overflow via SSL-VPN Requests
Title source: llmExploitation Summary
CVE-2022-42475 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 13, 2022, with confirmed use in ransomware campaigns. EIP tracks 10 public exploits from researchers including scrt, 0xhaggis, P4x1s. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits a heap overflow in Fortinet's SSLVPN daemon (CVE-2022-42475) to achieve remote code execution via a crafted ROP chain. It sends a malicious HTTP POST request with a large payload to trigger the vulnerability and execute a reverse shell.
Description
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
Exploits (10)
This PoC exploits a heap overflow in Fortinet's SSLVPN daemon (CVE-2022-42475) to achieve remote code execution via a crafted ROP chain. It sends a malicious HTTP POST request with a large payload to trigger the vulnerability and execute a reverse shell.
This is a functional exploit for CVE-2022-42475, a heap-based buffer overflow in Fortinet SSL-VPN. It leverages ROP chains and a connect-back shellcode to achieve remote code execution on vulnerable FortiGate devices.
This PoC exploits CVE-2022-42475, a buffer overflow vulnerability in Fortinet SSL VPN (sslvpnd), to achieve remote code execution (RCE) via a crafted payload sent over SSL. The exploit constructs a ROP chain to execute a reverse shell using Python.
This is a Python-based exploit for CVE-2022-42475, a heap overflow vulnerability in Fortinet's SSL-VPN daemon. It constructs a ROP chain to achieve remote code execution by sending a maliciously crafted POST request to the target.
This repository provides a Rust-based utility to scan Fortinet FortiGate devices for indicators of compromise (IOCs) related to CVE-2022-42475. It uses SSH to execute diagnostic commands and checks for specific files, strings, and IPs associated with the vulnerability.
This PoC exploits a heap overflow in Fortinet's SSLVPN daemon (CVE-2022-42475) to achieve remote code execution via a crafted ROP chain and reverse shell payload. It leverages hardcoded gadgets and a Python-based reverse shell to execute arbitrary commands on the target system.
This repository contains a functional exploit for CVE-2022-42475, a heap-based buffer overflow in Fortinet FortiOS SSL-VPN service. The exploit leverages ROP chains and a reverse shell payload to achieve pre-authentication remote code execution.
This repository contains a functional exploit for CVE-2022-42475, a heap-based buffer overflow vulnerability in Fortinet SSL VPN. The exploit leverages an integer overflow in the Content-Length header to achieve remote code execution (RCE) via a crafted HTTP request with a ROP chain and shellcode.
This PoC exploits CVE-2022-42475, a buffer overflow vulnerability in Fortinet FortiOS SSL-VPN, to achieve remote code execution (RCE) via a crafted HTTP POST request. The exploit constructs a ROP chain to execute a reverse shell payload.
This repository contains a functional exploit for CVE-2022-42475, a buffer overflow vulnerability in Fortinet SSL VPN (sslvpnd) that allows unauthenticated remote code execution. The exploit constructs a ROP chain to execute a reverse shell payload via a crafted HTTP POST request.
Nuclei Templates (1)
cpe:"cpe:2.3:o:fortinet:fortios" || http.html:"/remote/login" "xxxxxxxx" || http.favicon.hash:"945408572"
body="/remote/login" "xxxxxxxx" || icon_hash="945408572"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H