Medium · published January 22, 2019
CVSS calls it medium at 4.3. It is confirmed in active exploitation. It sits in the 98.6th percentile for exploit probability.
⚠️ A simple rogue LDAP request might let an attacker swipe your FortiGate LDAP credentials right out of the air! Think of it like a mischievous prankster fooling a delivery driver into dropping off a package at the wrong address — your valuable data ends up in the wrong hands simply because the right checks weren't in place. This vulnerability allows attackers to potentially gain access to sensitive LDAP server login credentials, which could lead to unauthorized access to critical resources. In the worst-case scenario, this could compromise your entire network, making it easier for attackers to launch further attacks.
Think of it like a mischievous prankster fooling a delivery driver into dropping off a package at the wrong address — your valuable data ends up in the wrong hands simply because the right checks weren't in place. This improper access control flaw allows an attacker to direct an LDAP connectivity test to a rogue server, retrieving the login credentials configured in FortiGate. The issue exists in FortiOS versions 6.0.2, 5.6.7 and earlier, as well as FortiADC versions 6.1.0, 6.0.0 to 6.0.1, and 5.4.0 to 5.4.4.
This vulnerability allows attackers to potentially gain access to sensitive LDAP server login credentials, which could lead to unauthorized access to critical resources. In the worst-case scenario, this could compromise your entire network, making it easier for attackers to launch further attacks. To mitigate this vulnerability, ensure you update to FortiOS 6.0.4 or FortiADC 6.1.1 and later. Additionally, review your LDAP server configurations to ensure they're pointed correctly and monitor your logs for any unauthorized connectivity requests. You've got this! Stay proactive, follow these steps, and keep your network secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fortinet/fortiadc | ≥ 5.4.0, < 5.4.5 | 5.4.5 |
| fortinet/fortiadc | ≥ 6.0.0, < 6.0.2 | 6.0.2 |
| fortinet/fortiadc | all versions | — |
| fortinet/fortios | < 6.0.3 | 6.0.3 |