Exploit for Out-of-bounds Write in Fortinet Fortios

## https://sploitus.com/exploit?id=F0D43129-9078-5B76-9D09-43877F3D9DD3
# CVE-2022-42475-RCE-POC

**Vulnerability Name**  
CVE-2022-42475: FortiGate RCE vulnerability POC  

**Cause of the Vulnerability**  
Due to a flaw in the validation of user input by sslvpnd, unauthenticated attackers can trigger a buffer overflow by sending specially crafted packets, ultimately allowing them to execute arbitrary code on the target system.  

**Affected Versions**  
2.0 = 7.2.3  
FortiOS >= 7.0.9  
FortiOS >= 6.4.11  
FortiOS >= 6.2.12  
FortiOS-6K7K >= 7.0.8  
FortiOS-6K7K >= 6.4.10  
FortiOS-6K7K >= 6.2.12  
FortiOS-6K7K >= 6.0.15  

**Fix**  
The official security patch has been released to address this vulnerability. It is recommended that affected users update their systems promptly:  
https://docs.fortinet.com/product/fortigate/7.2  

**IOC Self-Inspection**  
Check whether the following log entries exist in the system:  
`Logdesc="Application crashed" and msg="[…] application:sslvpnd,[…], Signal 11 received, Backtrace: […]"`  

Check the following files in the system:  
 `/data/lib/libips.bak`  
 `/data/lib/libgif.so`  
 `/data/lib/libiptcp.so`  
 `/data/lib/libipudp.so`  
 `/data/lib/libjepg.so`  
 `/var/.sslvpnconfigbk`  
 `/data/etc/wxd.conf`  
 `/flash`  

Users can check these files using the following commands:  
`diagnose sys last-modified-files /data/lib`  
`diagnose sys last-modified-files /var/`  
`diagnose sys last-modified-files /data/etc/`  
`diagnose sys last-modified-files /flash`