Saint Xortigate, Who Overflowed the VPN

Patron of SSL VPNs, gates on the perimeter, and patches released before the advisory.

Life

In June 2023 Charles Fol and Dany Bach of LEXFO announced a heap overflow in the FortiOS SSL VPN, reachable before any authentication and so exploitable by anyone to run code on the firewall. The name blends FortiGate with the XOR in the faulty routine. Fortinet shipped fixed versions a few days before the official advisory, and the bug soon landed in CISA's catalogue of exploited vulnerabilities.

Prayer

O Saint Xortigate, who enters through the very gate meant to protect us, let our VPNs check lengths before they decrypt. Amen.

How to celebrate

Celebrated by updating FortiOS and wondering, once again, whether the VPN really has to face the whole Internet.

A gate that overflows lets the wrong people through.