CVE-2019-5591 - FortiOS - Man-in-the-Middle 💰 #13436
Description
Description:
FortiOS contains a default configuration vulnerability caused by improper LDAP server impersonation protection, letting unauthenticated attackers on the same subnet intercept sensitive information.
Severity: Medium (CVSS: 6.5)
Vulnerability Details:
- CVE ID: CVE-2019-5591
- CWE: CWE-306 (Missing Authentication for Critical Function)
- Affected Product: FortiOS (multiple versions)
- Attack Vector: Adjacent Network
- Authentication: None Required
- Impact: Information Disclosure (Man-in-the-Middle)
POC:
KEV: True ✅
CISA KEV: Added 2021-11-03
Known Ransomware Campaign: Yes (exploited by Iranian threat actors)
EPSS Score: 0.02564 (84.995th percentile)
Shodan Query: cpe:"cpe:2.3:o:fortinet:fortios"
Exposure: ~472,971 hosts potentially exposed
Acceptance Criteria:
The template must include a complete POC and should not rely solely on version-based detection. Contributors must share vulnerable setup information or a testable instance by emailing [email protected]. Providing a testable instance significantly reduces validation time and increases the chance of quicker rewards. Templates that are incomplete, invalid, or non-verifiable will not be accepted. Avoid submitting code templates for CVEs that can be detected using HTTP, TCP, or JavaScript only these are blocked by default and will not produce results. Exceptions may apply for certain cases. Do not submit AI-simulated vulnerable environments. To qualify for the bounty, the team must be able to fully validate the POC. If you have hosted a vulnerable environment for validation, send the details (IP or Docker setup) along with the PR number to templates[at]projectdiscovery.io
Note: This vulnerability has been actively exploited by Iranian threat actors and in ransomware campaigns. Requires network adjacency for exploitation.
References:
- https://www.fortiguard.com/psirt/FG-IR-19-037
- https://www.tenable.com/blog/frequently-asked-questions-about-iranian-cyber-operations
- https://www.hhs.gov/sites/default/files/iranian-threat-actors-and-healthcare.pdf
- https://cert-in.org.in/PDF/RANSOMWARE_Report_2022.pdf
- https://www.ic3.gov/media/news/2021/210527.pdf
You can check the FAQ for the Nuclei Templates Community Rewards Program here