Fortinet Fortigate heap-based buffer overflow in sslvpnd (FG-IR-22-398)

#TRUSTED 0419b0502539e3b904b23f7aec42220e45c898c47cf6e1cf954ee15e61a1901f7897c5284ec434f56b7e01afe3f2b7328f0c8f172e6cf7311aa0cf3ffb6a8dbc107c344cab8fe035de727bb058c83c81129e39ada6f127ed6aecbf6e4be01b2966a4a9674c1c3806f9886fc5a3fefa7ae04a1f900a1747d8fadcc0e572a7ce1f059e9f60d5736c16a1b43167acf634723b865ea2b856fcfd451e573d5df4369fd56ade67d92cddb63f651dea813f122f5fa6869fabdbaaff770a77ab9a2d59cbf9fd4e8f71af63693e4182eca5e4ea1948a405adc2fcd632d7dce9fb60e0f52d0e8fbccf36efde34a72b7af415bc3dfac134c88d126ed7649fca45bce010871281623bbe9111707b48cac5121bafe17aa7b13da459038b5e26591dde82bc2fd415919f8820cb77f75cee860cd61790da5c1a45d9024184de7368e3a6fe277772b2e486e88f41561cd8aa5c51fc0f5e85a9d72ec5431ecf8819acf24725cd1756456a9983fa5e780e7ce13f06c2b77397f2ed2378d953458906805be4043b07ee6317b87ea80df6249a716bf796e31945d7184fe31f3fd14d826cf542a39c8637f6741e6af5ac81839c105bd17e5113c175db79a4e7729f668b1c82c6e0aa70e84895116a96041c5ae051f8bda0ae08f582c976f38ba8d47fe46667a24afcdf8c6d1d42466c3cf2b17c38f59587e495f9d4ad84991d691d09681fc1dae961a82c
#TRUST-RSA-SHA256 07de9cff2615c98c276381657c11fd29239f08f85ed034568d33846ddfe626802a55ba1641709e5d35cf9feed1405cd35da44aa45e3d222ddd1af9320772908c4f2ab79061e21e5d5f0aefa7d85b255e69c6db28e624aaaf610d316727d86ad1a250f3d4379cecba3556d4b28af650d18a6d3ea1cf978069e989c8afe69e97b23f9220aac7c639aec74112dd5cf4c88dd2d4b2bf56e4ff5ce8be0f887d57ac4f7fbaffca358b92a85ffefa50286bd2b0af18b45e2a3c1511f51492f59678eabac979e75e7f9e5305d623d005b6a330794e838c0f5a8384828d1ff299c091e15040d8130a3345c7970ed532f996696c3806fa6eafd351d48d96779a405bd9adb13292368efc7513858e1c6bb4984e91ff4ee63201120db7557d75a1286c83a14f6c9bf4367951edc49487bced0f2b83ef73273c4ede732530a3143ab3734ad241a8b47a8f881397911c11f416a51e95e20c3f958cf2feb5e2d3cc9a70cd1e1ee16e2916cb5d7705ed41c7c2a138322268a85e252e936b5704bc2a0c461efc17cfaae24fd79d386a95c2c56009bfdf3c0a63749c7e1331d85b76ea7b96a5fb1dc299d46e258f463bec7f8bf425eb21843cb4c5b669febbee2bd8ef4915259ef9bb97ba4b202124a62acc07d3947cd0024198a3ba2e8aec41850616f6f199a82a77f2468d80f38e93e02bfa10e516259555783382c6236815393f3a915b167588ef
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(168637);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/31");

  script_cve_id("CVE-2022-42475");
  script_xref(name:"IAVA", value:"2022-A-0512-S");
  script_xref(name:"CEA-ID", value:"CEA-2022-0038");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2023/01/03");
  script_xref(name:"CEA-ID", value:"CEA-2023-0044");

  script_name(english:"Fortinet Fortigate heap-based buffer overflow in sslvpnd (FG-IR-22-398)");

  script_set_attribute(attribute:"synopsis", value:
"Fortinet Firewall is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The version of Fortigate installed on the remote host is 5.0.0 through 5.0.14, 5.2.0 through 5.2.15, 5.4.0 through
5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.15, 6.2.x prior to 6.2.12, 6.4.x prior to 6.4.11, 7.0.x prior to 7.0.9,
or 7.2.x prior to 7.2.3. It is, therefore, affected by a heap-based buffer overflow vulnerability as referenced in the
FG-IR-22-398 advisory.

  - A heap-based buffer overflow vulnerability in FortiOS SSL-VPN may allow a remote unauthenticated
    attacker to execute arbitrary code or commands via specifically crafted requests. (CVE-2022-42475)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.fortiguard.com/psirt/FG-IR-22-398");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Fortigate version 7.2.3, 7.0.9, 6.4.11, or 6.2.12 or later. As a workaround, disable SSL-VPN.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-42475");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/12/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/12/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fortinet:fortios");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Firewalls");

  script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("fortinet_version.nbin");
  script_require_keys("Host/Fortigate/version", "Host/Fortigate/model");

  exit(0);
}

include('vcf_extras_fortios.inc');

var app_name = 'Fortigate';
var app_info = vcf::get_app_info(app:app_name, kb_ver:'Host/Fortigate/version');

vcf::fortios::verify_product_and_model(product_name:app_name);

var constraints = [
  { 'min_version' : '5.0.0', 'max_version' : '5.0.14', 'fixed_version' : '6.2.12' },
  { 'min_version' : '5.2.0', 'max_version' : '5.2.15', 'fixed_version' : '6.2.12' },
  { 'min_version' : '5.4.0', 'max_version' : '5.4.13', 'fixed_version' : '6.2.12' },
  { 'min_version' : '5.6.0', 'max_version' : '5.6.14', 'fixed_version' : '6.2.12' },
  { 'min_version' : '6.0.0', 'max_version' : '6.0.15', 'fixed_version' : '6.2.12' },
  { 'min_version' : '6.2.0', 'fixed_version' : '6.2.12' },
  { 'min_version' : '6.4.0', 'fixed_version' : '6.4.11' },
  { 'min_version' : '7.0.0', 'fixed_version' : '7.0.9' },
  { 'min_version' : '7.2.0', 'fixed_version' : '7.2.3' }
];

# diagnose sys top <Delay_in_seconds> <Maximum_lines_to_display> <Iterations_to_run>
# We want to make sure we see all processes and only display it once
# If sslvpnd is not running, host is not currently vulnerable
var workarounds = [{config_command:'diagnose sys top 1 200 1', config_value:'sslvpnd', misc_cmd:TRUE}];

vcf::fortios::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  workarounds:workarounds,
  show_check:'Run Time:',
  not_equal:TRUE,
  severity:SECURITY_HOLE
);