XORtigate: FortiOS/FortiProxy SSL-VPN Heap-Based Buffer Overflow RCE

This repository provides a Python proof-of-concept exploit for CVE-2023-27997, a critical heap-based buffer overflow vulnerability in Fortinet FortiGate SSL-VPN (FortiOS) devices. The exploit consists of a single main script ('fgt-cve-2023-27997-exploit.py'), a README.md with detailed usage and technical background, and a requirements.txt listing dependencies (requests, urllib3, numpy, scipy). The exploit works by first retrieving a 'salt' value from the target's '/remote/info' endpoint, then crafting a ROP chain payload (demonstrated with a ping command), encrypting it, and sending it to the vulnerable '/remote/hostcheck_validate' endpoint as the 'enc' parameter. The script is designed for authorized testing and demonstrates remote code execution (RCE) without authentication. The README provides affected version ranges for FortiOS and FortiProxy, usage instructions, and technical details about the vulnerability and exploit chain. The attack vector is network-based, targeting the SSL-VPN web interface. The exploit is a PoC and requires the attacker to specify the target IP and port.

This repository contains a proof-of-concept (POC) exploit for CVE-2023-27997, a critical remote code execution vulnerability in Fortinet FortiGate SSL VPN devices. The main file, 'exploit.py', is a heavily commented Python script that demonstrates the exploitation process, including buffer overflow and ROP chain construction, but does not provide a fully weaponized payload. The exploit requires the attacker to specify the target (host:port) and a local callback address. It uses custom SSL/TLS connections and crafts HTTP(S) requests to the '/remote/error' endpoint on the target device. The script is intended for educational purposes and does not include fingerprinting or vulnerability checks. The README.md provides a brief overview and points to a detailed blog post for further information. The exploit demonstrates the attack vector and methodology but is not directly usable for real-world attacks without further development.