Description
Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6.7 and 6.0.0 to 6.0.4 are vulnerable to a path traversal vulnerability within the SSL VPN web portal which allows unauthenticated attackers to download FortiOS system files through specially crafted HTTP requests.
This module exploits this vulnerability to read the usernames and passwords of users currently logged into the FortiOS SSL VPN, which are stored in plaintext in the "/dev/cmdb/sslvpn_websession" file on the VPN server.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/gather/fortios/vpnssl_traversal_creds_leakmsf undefined(vpnssl_traversal_creds_leak) > show actions ...actions...msf undefined(vpnssl_traversal_creds_leak) > set ACTION < action-name >msf undefined(vpnssl_traversal_creds_leak) > show options ...show and set options...msf undefined(vpnssl_traversal_creds_leak) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub