Five-year-old Fortinet FortiOS SSL VPN vulnerability actively exploited

Fortinet has disclosed a five-year-old FortiOS SSL VPN vulnerability, tracked as CVE-2020-12812, which allows an authentication bypass by altering the case of a username when two-factor authentication is enabled with LDAP. FortiGate systems in certain configurations may skip local 2FA and authenticate via LDAP, enabling access without the second factor and potentially compromising admin or VPN access.

Fortinet says the issue arises from how FortiGate treats usernames as case-sensitive by default when the LDAP directory is case-insensitive, and it affects cases where local 2FA users are linked to LDAP and used in authentication policies. Organisations can mitigate by disabling username case sensitivity via set username-case-sensitivity disable, or set username-sensitivity disable for newer FortiOS releases, so all case variations are treated the same.

The advisory and subsequent notices highlighted by authorities include an April 2021 joint alert from the FBI and CISA and a July 2021 joint advisory by CISA, ACSC, NCSC, and FBI detailing top exploited vulnerabilities, including CVE-2020-12812. According to Fortinet’s advisory FG-IR-19-283, Fortinet addressed the vulnerability in FortiOS 6.0.10, 6.2.4, and 6.4.1 in July 2020.