Fortinet FortiAuthenticator Vulnerable to LDAP Injection, Bypassing Authentication
Fortinet has disclosed an LDAP injection vulnerability in FortiAuthenticator that could allow authenticated attackers to bypass authentication mechanisms.
Fortinet's Product Security Incident Response Team (PSIRT) has issued an advisory detailing a critical vulnerability, identified as FG-IR-26-255, within its FortiAuthenticator product. The flaw, classified as an Improper Neutralization of Special Elements Used in an LDAP Query (CWE-90), carries a CVSSv3 score of 8.2, indicating a high severity.
Successful exploitation of this vulnerability could enable an authenticated attacker to bypass the authentication process. This bypass is contingent on specific conditions related to the configuration of the upstream Identity Provider (IdP). Attackers would need either a compromised or malicious upstream IdP, or an IdP configuration where the user has control over the NameID or a specific SAML attribute that is used as the username.
The vulnerability affects a wide range of FortiAuthenticator versions, including all releases from 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. This broad impact highlights the potential scope of exposure for organizations relying on FortiAuthenticator for identity and access management.
The advisory notes that the vulnerability was discovered internally by Gwendal Guegniaud of the Fortinet Product Security team, utilizing the Claude Mythos AI model. This internal discovery and reporting process underscores the ongoing efforts within vendors to proactively identify and address security weaknesses.
While the advisory does not explicitly detail the exact technical steps for exploitation, the nature of LDAP injection suggests that attackers could manipulate LDAP queries to gain unauthorized access. This could involve injecting special characters or commands into fields that are used to construct LDAP queries, thereby altering the intended query's logic and potentially returning unintended results or granting elevated privileges.
Fortinet has not yet released specific patches for this vulnerability, but the advisory is marked as 'Final', suggesting that further updates or patches may be forthcoming. Organizations using affected versions of FortiAuthenticator are strongly advised to review their IdP configurations and consider implementing mitigating controls where possible until patches are available.
This vulnerability serves as a reminder of the importance of secure configuration for identity solutions and the potential risks associated with complex authentication flows, particularly those involving SAML and external IdPs. The reliance on AI in the discovery process also points to the evolving landscape of vulnerability research.