Sigma rule: Exploitation Indicator Of CVE-2022-42475

Rule

Title

Exploitation Indicator Of CVE-2022-42475

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems), Nilaa Maharjan, Douglasrose75

Date

2024-02-08

File

rules-emerging-threats/2022/Exploits/CVE-2022-42475/fortios_sslvpnd_exploit_cve_2022_42475_exploitation_indicators.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects exploitation indicators of CVE-2022-42475 a heap-based buffer overflow in sslvpnd.

Log source

product

fortios

service

sslvpnd

definition

Requirements: file creation events or equivalent must be collected from the FortiOS SSL-VPN appliance in order for this detection to function correctly

Detection

keywords:
    - '/data/etc/wxd.conf'
    - '/data/lib/libgif.so'
    - '/data/lib/libips.bak'
    - '/data/lib/libiptcp.so'
    - '/data/lib/libipudp.so'
    - '/data/lib/libjepg.so'
    - '/var/.sslvpnconfigbk'
condition: keywords

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• cve.2022-42475
• detection.emerging-threats

CVEs this rule names

• CVE-2022-42475

References

• https://www.fortiguard.com/psirt/FG-IR-22-398
• https://www.bleepingcomputer.com/news/security/fortinet-says-ssl-vpn-pre-auth-rce-bug-is-exploited-in-attacks/
• https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/
• https://community.fortinet.com/t5/FortiGate/Technical-Tip-Critical-vulnerability-Protect-against-heap-based/ta-p/239420

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2022/Exploits/CVE-2022-42475/fortios_sslvpnd_exploit_cve_2022_42475_exploitation_indicators.yml