1
2name: crowdsecurity/vpatch-CVE-2018-13379
3description: "Fortinet FortiOS - Credentials Disclosure (CVE-2018-13379)"
4rules:
5  - and:
6    - zones:
7      - METHOD
8      match:
9        type: equals
10        value: GET
11    - zones:
12      - URI
13      transform:
14      - lowercase
15      match:
16        type: contains
17        value: /remote/fgt_lang
18    - zones:
19      - ARGS
20      name: lang
21      transform:
22      - lowercase
23      match:
24        type: contains
25        value: ../
26labels:
27  type: exploit
28  service: http
29  confidence: 3
30  spoofable: 0
31  behavior: "http:exploit"
32  label: "Fortinet FortiOS - Credentials Disclosure"
33  classification:
34   - cve.CVE-2018-13379
35   - attack.T1595
36   - attack.T1190
37   - cwe.CWE-22