Fixed: CVE-2019-5591 - FortiOS - Man-in-the-Middle #13436

[Rukhnuddin786]

Fixed: CVE-2019-5591 - FortiOS - Man-in-the-Middle #13436

This pull request adds a comprehensive Nuclei template for CVE-2019-5591, a medium-severity default configuration vulnerability in FortiOS that allows for Man-in-the-Middle attacks on LDAP traffic.

This vulnerability is listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and has been actively exploited by threat actors in ransomware campaigns, making its detection critical for organizations.

The template uses a multi-stage detection method, first fingerprinting a FortiOS device via its login page and then querying a legitimate API endpoint (/api/v2/monitor/system/status) to confirm the vulnerable version. This approach ensures high accuracy and avoids false positives.

• Added CVE-2019-5591
• References:
  • https://www.fortiguard.com/psirt/FG-IR-19-037
  • https://nvd.nist.gov/vuln/detail/CVE-2019-5591
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog (KEV Entry)
  • https://www.tenable.com/blog/frequently-asked-questions-about-iranian-cyber-operations (Threat Actor Exploitation)

/claim #13436
/attempt #13436

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

• Shodan Query: cpe:"cpe:2.3:o:fortinet:fortios" or http.favicon.hash:945408572
• Fofa Query: app="FORTINET-FortiGate" or icon_hash=945408572
• Google Query: intitle:"FortiGate"

HTTP Matched Response Data Snippet:

The template triggers upon identifying a vulnerable version from the /api/v2/monitor/system/status endpoint.

{
  "serial": "FGT60E1234567890",
  "version": "v6.0.3,build0326,190104 (GA)",
  "hostname": "FortiGate-60E",
  "operating_mode": "normal"
}

[Rukhnuddin786]

/attempt #13436

[pussycat0x]

Hi @Rukhnuddin786, Thank you for your interest in contributing templates to the project. At this time, we require templates that demonstrate that demonstrate full exploitation rather than just detection. While this submission does not meet the requirements for the Bounty Program, but we can accept it as a version detection template for the Passive. Please let us know if you agree with this.

[Rukhnuddin786]

Hi @pussycat0x, Yes, I agree with that. Thank you for considering my submission as a version detection template for the Passive project. I understand the requirements for the Bounty Program and will keep them in mind for future contributions. Thanks, Md Rukhnuddin

…

On Wed, 1 Oct 2025 at 06:57, pussycat0x ***@***.***> wrote: *pussycat0x* left a comment (projectdiscovery/nuclei-templates#13438) <#13438 (comment)> Hi @Rukhnuddin786 <https://github.com/Rukhnuddin786>, Thank you for your interest in contributing templates to the project. At this time, we require templates that demonstrate that demonstrate full exploitation rather than just detection. While this submission does not meet the requirements for the Bounty Program, but we can accept it as a version detection template for the Passive. Please let us know if you agree with this. — Reply to this email directly, view it on GitHub <#13438 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3GHSN673YK7SSDYUICGCRT3VPMU5AVCNFSM6AAAAACH4XMAT2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGNJWGQ4DGMRSGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>