CVE-2018-13374

Fortinet FortiOS (FortiGate) and FortiADC contain an improper access control flaw (CWE-732) related to the LDAP server connectivity test feature. An attacker can point an LDAP connectivity test request to a rogue LDAP server under their control, causing FortiGate to transmit its configured LDAP server login credentials to that server. Capturing these credentials yields valid LDAP bind credentials — typically Active Directory usernames and passwords — that can be reused for further access into the victim's directory environment. Organizations running affected FortiGate (FortiOS) or FortiADC appliances with LDAP authentication configured are exposed; the available data does not specify exact affected version ranges. The flaw is listed in CISA's KEV (added 2022-09-08) with known ransomware use, and EPSS assigns a 37.8% probability of exploitation within 30 days (98th percentile).

What to do: Apply updates per Fortinet's vendor instructions on both FortiOS and FortiADC, as required by the CISA KEV listing. After patching, rotate the LDAP bind credentials configured on FortiGate in case they were captured, and review logs for LDAP connectivity test requests directed at unexpected or unauthorized LDAP servers.