XORtigate: Pre-Authentication RCE in FortiGate SSL VPN
· 26:14 · Watch on YouTube ↗
Summary
Charles Fol describes a pre-authentication remote-code-execution flaw in FortiGate SSL VPN, where an encrypted-parameter length-check error enables targeted memory modification. He reports that a red-team exploit captured enterprise credentials.
Key points
- Fol says his team found the flaw while conducting a red-team assessment of an internet-facing FortiGate SSL VPN.
- A length check compared the decrypted size in bytes with the payload length in hexadecimal characters, allowing decryption to XOR beyond the buffer into adjacent memory.
- Applying the same XOR keystream repeatedly enabled a targeted one-byte overwrite; the exploit used it to alter an OpenSSL-managed SSL handshake callback and trigger code execution.
- The talk describes heap grooming and different exploit approaches for Intel and ARM builds; Fol says the ARM exploit was unstable and worked only when the server was otherwise idle.
- Fol reports that the assessment captured employees' cleartext VPN credentials, including those of four domain administrators, over roughly four hours.
- Fol said one exploit had been published on GitHub and referred to a Fortinet advisory. He did not provide affected-version details or patch status.
Article Details
- Topics
- [00:08] XORtigate vulnerability and red-team assessment context
- [01:16] Appliance setup and firmware archive path traversal for local debugging
- [04:00] Encrypted parameter parsing and the length-check flaw
- [09:38] Repeated XOR operations as a targeted memory-write primitive
- [13:21] SSL handshake callback overwrite and heap layout for code execution
- [20:26] Adapting the exploit to ARM builds and discussing its limitations
- [23:42] Reported credential capture and live exploit demonstration
- [25:03] Affected-version discussion, exploit publication, and vendor advisory
MITRE ATT&CK
T1056.003 · Web Portal CaptureAfter gaining code execution, the presenter says he hooked the VPN login procedure to capture users' credentials in clear text.T1190 · Exploit Public-Facing ApplicationThe red-team exploit targeted a pre-authentication vulnerability in an internet-facing FortiGate SSL VPN interface to obtain code execution.