CVE-2018-13374
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
Description
CVE-2018-13374 is an improper access control vulnerability in Fortinet FortiOS and FortiADC that allows attackers to obtain LDAP server login credentials configured in the FortiGate appliance. By redirecting an LDAP server connectivity test request to a rogue LDAP server, an attacker can capture the stored credentials in cleartext. This vulnerability is significant because FortiGate appliances are widely deployed as network security infrastructure, and exposed LDAP credentials can enable lateral movement within enterprise Active Directory environments. CISA has added CVE-2018-13374 to its Known Exploited Vulnerabilities catalog with a known association to ransomware campaigns, and the EPSS score of 1.59% (81st percentile) indicates moderate exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiadc | >= 5.4.0, < 5.4.5; >= 6.0.0, < 6.0.2; 6.1.0 |
| fortinet | fortios | < 6.0.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://fortiguard.com/advisory/FG-IR-18-157(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13374(US Government Resource)
Weakness Type
CWE-284: Improper Access Control
CVE-2018-13374 exploits an improper access control weakness in Fortinet FortiOS and FortiADC, where the LDAP server connectivity test function does not properly restrict who can initiate test requests or validate the target server address. This allows an attacker to point the connectivity test to an attacker-controlled LDAP server, causing the FortiGate appliance to transmit stored LDAP credentials to an unauthorized destination.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2018-13374 poses a significant risk to enterprise network security. The vulnerability enables credential theft from Fortinet security appliances, which typically hold privileged LDAP credentials used for authenticating VPN users, administrators, and network services against Active Directory. Compromised LDAP credentials can be leveraged for unauthorized access to directory services, enabling enumeration of users and groups, password spraying attacks, and lateral movement throughout the enterprise environment. The confirmed association with ransomware campaigns significantly amplifies the business impact, as stolen LDAP credentials provide attackers with the authentication material needed to spread ransomware across domain-joined systems. With an EPSS score of 1.59% (81st percentile), active exploitation has been observed in targeted attacks against organizations using FortiOS and FortiADC.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2018-13374 in the wild and has specifically flagged it as being used in ransomware campaigns. The EPSS score of 1.59% (81st percentile) reflects moderate exploitation probability, with the vulnerability being exploited in targeted attacks rather than broad automated scanning campaigns. The attack technique of redirecting LDAP connectivity tests to rogue servers is well-understood and does not require sophisticated tools to execute. The combination of credential theft capability and ransomware association makes this a high-priority remediation target for organizations running affected Fortinet products.
Remediation
- Apply Fortinet security updates: Per the CISA KEV required action, apply updates per vendor instructions as documented in Fortinet advisory FG-IR-18-157. Upgrade FortiOS and FortiADC to the patched versions specified in the advisory.
- Rotate LDAP credentials immediately: After patching, change all LDAP service account passwords configured on FortiGate appliances, as they may have already been compromised. Update the credentials in both Active Directory and the FortiGate configuration.
- Restrict management interface access: Ensure that FortiGate management interfaces are not accessible from untrusted networks. Implement strict IP-based access controls for administrative access and use out-of-band management networks where possible.
- Monitor Active Directory for anomalous authentication: Review AD authentication logs for suspicious login attempts using the LDAP service accounts configured on FortiGate, particularly from unexpected source IP addresses or at unusual times.
- Implement LDAP channel binding and signing: Configure LDAP channel binding and LDAP signing on Active Directory domain controllers to mitigate the risk of credential interception during LDAP authentication, reducing the impact of similar credential exposure vulnerabilities.
Technical Details
CVE-2018-13374 is an improper access control vulnerability in the LDAP server connectivity test functionality of Fortinet FortiOS and FortiADC. The FortiGate management interface provides a feature to test connectivity to configured LDAP servers, which sends the stored LDAP bind credentials to the specified server to verify authentication. The vulnerability exists because this functionality does not adequately validate the destination server address, allowing an attacker with access to the management interface to modify the test target to point to an attacker-controlled LDAP server. When the connectivity test is executed, the FortiGate appliance transmits the stored LDAP bind DN (Distinguished Name) and password in cleartext to the rogue server, where the attacker can capture them. This is particularly impactful because FortiGate appliances typically store privileged service account credentials used for LDAP-based authentication of VPN users and administrative access.
Frequently Asked Questions
Is CVE-2018-13374 being actively exploited?
Yes. CISA has added CVE-2018-13374 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The vulnerability has been specifically associated with ransomware campaigns, where stolen LDAP credentials are used to facilitate lateral movement and ransomware deployment within enterprise networks.
What products are affected by CVE-2018-13374?
CVE-2018-13374 affects Fortinet FortiOS and FortiADC. The vulnerability is present in versions of these products prior to the patches documented in Fortinet advisory FG-IR-18-157. Organizations using FortiGate appliances with LDAP authentication configured are at risk.
How do I fix CVE-2018-13374?
Apply the security updates documented in Fortinet advisory FG-IR-18-157 to patch the access control flaw. After patching, immediately rotate all LDAP service account credentials configured on the FortiGate appliance. Additionally, restrict management interface access to trusted networks only.
How severe is CVE-2018-13374?
CVE-2018-13374 is a significant credential theft vulnerability with confirmed use in ransomware campaigns. The EPSS score of 1.59% (81st percentile) reflects moderate exploitation probability. While the vulnerability itself enables credential disclosure rather than direct code execution, the stolen LDAP credentials provide attackers with powerful authentication material for lateral movement in enterprise environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.