CVE-2018-13374

Fortinet LDAP Credential Disclosure in FortiOS and FortiADC (CVE-2018-13374)

AI-generated analysis based on the vulnerability data on this page.

Summary

Fortinet FortiOS and FortiADC contain an access control flaw that exposes configured LDAP credentials when an administrator initiates a connectivity test. An attacker with sufficient privileges can redirect the test to a rogue LDAP server and capture the authentication credentials sent during the check.

Background

Fortinet FortiOS is the operating system powering FortiGate next-generation firewalls, while FortiADC is an application delivery controller. Both products support LDAP integration for authentication and directory services. During troubleshooting or configuration verification, administrators can initiate LDAP server connectivity tests from the management interface. This feature became a target for credential theft when it was found to lack sufficient access controls over the destination of the test request.

Root Cause

The vulnerability is classified as CWE-732. The root cause lies in the improper validation of the LDAP server endpoint during connectivity tests. When an administrator triggers a test, the device transmits the configured bind credentials to verify authentication. The implementation fails to enforce that the test request reaches only the pre-configured, legitimate LDAP server, allowing an attacker to substitute or redirect the request to an attacker-controlled endpoint without adequate authorization checks.

Impact

The CVSS v3.1 score is 4.3 (Medium), with a confidentiality impact rated Low. The attack vector is Network, complexity is Low, and requires Low privileges. No integrity or availability impact is assessed. The primary risk is credential disclosure: an attacker who obtains LDAP bind credentials can reuse them to access directory services, escalate privileges within the enterprise, or pivot to other systems that rely on the same credentials. The EPSS score of 0.38088 places this vulnerability in the 98.37th percentile, indicating a historically high probability of exploitation.

Exploitation Walkthrough

From a defensive perspective, the attack flow is straightforward. An attacker with administrative or sufficient configuration privileges accesses the LDAP server settings and initiates a connectivity test. By manipulating network conditions or DNS resolution, the attacker directs the test traffic to a rogue LDAP server under their control. The Fortinet device then sends the stored bind credentials to the rogue server during the authentication phase, allowing the attacker to capture them.

Ethics caveat: This description is intentionally generic and defensive in nature. It is provided to help defenders understand the attack surface and test their own compensating controls. Weaponized exploit code or step-by-step instructions for unauthorized exploitation are not included.

Affected and Patched Versions

Affected products include:

• Fortinet FortiOS 6.0.2, 5.6.7, and earlier versions
• Fortinet FortiADC 6.1.0, 6.0.0 to 6.0.1, and 5.4.0 to 5.4.4

Specific patch information is not available in the source data. Organizations should consult the FortiGuard advisory referenced below for the definitive list of fixed releases and upgrade paths.

Remediation

1. Upgrade: Apply the latest patched firmware provided by Fortinet for FortiOS and FortiADC. Verify through the FortiGuard advisory that the installed version is no longer affected.
2. Compensating controls: Until patching is complete, restrict administrative access to Fortinet management interfaces to trusted networks and enforce multi-factor authentication for admin accounts. Monitor LDAP credential usage for anomalous authentication patterns from unexpected sources.

Detection

• Monitor firewall and network logs for LDAP connections from Fortinet management interfaces to unexpected or external IP addresses.
• Review administrative audit logs for unauthorized or unusual connectivity test events.
• Correlate LDAP bind attempts with baseline directory server IP addresses; deviations may indicate credential redirection.
• Leverage SIEM rules to flag FortiOS and FortiADC management sessions that trigger external LDAP traffic.

Assessment

This vulnerability was added to the CISA Known Exploited Vulnerabilities Catalog on 2022-09-08, confirming real-world exploitation. With an EPSS score of 0.38088 and a 98.37th percentile ranking, it is among the most reliably exploited historical CVEs. The relatively low CVSS v3.1 score of 4.3 reflects limited confidentiality impact, but the exposure of LDAP credentials can cascade into broader domain compromise. Two lessons emerge: first, connectivity-test features must validate destination endpoints strictly; second, credentials stored in network appliances should be rotated regularly and monitored for anomalous reuse.

References

• https://fortiguard.com/advisory/FG-IR-18-157
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13374