Fortinet Warns of New Attacks Exploiting Old Vulnerability

Fortinet has warned that a five-year-old FortiOS improper authentication flaw, tracked as CVE-2020-12812, is once again in attackers’ crosshairs, enabling a bypass of two-factor authentication under certain configurations. The vulnerability exists because FortiGate and LDAP Directory handle authentication differently, allowing attackers to change the case of a username so that the second factor is not requested, Fortinet says.

Fortinet notes that this abuse has previously been used by ransomware groups and state-sponsored threat actors, and that attackers are again exploiting it against specific configurations. Mitigations were rolled out in FortiOS versions 6.0.10, 6.2.4 and 6.4.1, and organisations are advised to update to newer iterations; if username-sensitivity is disabled, FortiGate will treat mixed-case usernames as identical to prevent misconfigurations.

According to Fortinet, organisations should remove any secondary LDAP Group if it is not required and reset all credentials, including those used in LDAP/AD Binding.