Executive Summary

This vulnerability affects Fortinet FortiOS versions up to 7.6.6 and allows attackers to decrypt LDAP credentials stored in device configuration files. The issue arises because the encryption key used to protect these credentials is the same across all customer installations by default. Although there is a non-default option to enable stronger encryption, it is not enabled by default due to potential disruptions in functionality.

Useful 0 Not Useful 0

Impact Analysis

An attacker who exploits this vulnerability can decrypt LDAP credentials stored in the device configuration files. This could lead to unauthorized access to LDAP services, potentially exposing sensitive authentication information. Since the encryption key is shared across installations by default, multiple customers could be affected if an attacker obtains the key.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability arises because Fortinet FortiOS through version 7.6.6 uses the same encryption key across all customers by default to encrypt LDAP credentials in device configuration files.

To mitigate this vulnerability, customers should enable the non-default option that eliminates this weakness by using private data encryption with a unique key per installation.

However, enabling this option may disrupt functionality as noted in Fortinet's documentation on managing FortiGates with private data encryption.

Therefore, the immediate step is to evaluate enabling this non-default private data encryption option despite potential disruptions, to prevent attackers from decrypting LDAP credentials.

Useful 0 Not Useful 0