FortiAuthenticator LDAP injection can bypass authentication
Original title: Improper neutralization of special elements used in an ldap query
Exploitation needs a malicious or compromised upstream IdP, or user control of the NameID or username attribute.
Fortinet PSIRT reports an LDAP injection flaw in FortiAuthenticator that may let an authenticated attacker bypass authentication. Successful exploitation requires a malicious or compromised upstream identity provider, or an IdP configuration that lets the user control the NameID or the SAML attribute used as the username. The CVSS v3 score is 8.2. Versions, a fix and a CVE are not in the snippet.
Unconfirmed: Affected versions, a fix, a CVE and exploitation status are not stated.
- CVSS v3 score is 8.2.
- Fortinet classifies the issue as CWE-90.
- A compromised IdP or user-controlled NameID is required.
- The advisory was revised on November 10.
Impact: Authentication bypass under specific IdP conditions
| Product | Affected |
|---|---|
| Fortinet FortiAuthenticator | — |
- Vendors
- Fortinet
- Products
- FortiAuthenticator
From the original article
CVSSv3 Score: 8. 2 An Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')[CWE-90] in FortiAuthenticator may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.