CVE-2020-12812:Improper authentication vulnerability in Fortinet FortiOS SSL VPN allows users to bypass two-factor authentication by changing username case.

splash
Back

Description Preview

A vulnerability in Fortinet FortiOS SSL VPN (versions 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below) allows users to bypass the second factor of authentication (FortiToken) by simply changing the case of their username during login. This vulnerability (CVE-2020-12812) is classified as an improper authentication issue (CWE-287) and a string case sensitivity issue (CWE-178). When exploited, an attacker with knowledge of a valid username can gain unauthorized access to the SSL VPN by manipulating the case of the username characters, effectively bypassing the FortiToken verification step that would normally be required.

Overview

This vulnerability affects the authentication mechanism in Fortinet FortiOS SSL VPN services. The issue stems from case sensitivity problems in the username validation process. When a user attempts to log in with a modified case version of their username (e.g., "Admin" instead of "admin"), the system incorrectly authenticates the user after the first factor (password) without requiring the second authentication factor (FortiToken). This represents a significant security weakness as it effectively negates the protection provided by two-factor authentication, allowing attackers with knowledge of valid credentials to gain unauthorized VPN access without possessing the physical FortiToken or mobile authenticator app required for complete authentication.

Remediation

Organizations using affected versions of FortiOS should immediately upgrade to the following patched versions:

  • FortiOS 6.4.1 or above
  • FortiOS 6.2.4 or above
  • FortiOS 6.0.10 or above

Additional security measures to implement:

  1. Audit VPN access logs for signs of exploitation, looking for login attempts with case variations of legitimate usernames.
  2. Implement IP-based restrictions for VPN access where possible.
  3. Ensure strong password policies are in place.
  4. Consider implementing additional network segmentation to limit access from VPN users.
  5. Monitor for unusual login patterns or access attempts.
  6. Review and validate all VPN user accounts to ensure only authorized users have access.

References

  1. Fortinet PSIRT Advisory: https://fortiguard.com/psirt/FG-IR-19-283
  2. MITRE CWE-287: Improper Authentication
  3. MITRE CWE-178: Improper Handling of Case Sensitivity
  4. CVE-2020-12812 in the National Vulnerability Database

Early Warning

Armis Early Warning customers received an advanced alert on this vulnerability.

Armis Alert Date
Jun 12, 2021
CISA KEV Date
Nov 3, 2021
144days early
Learn More

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing
    Manufacturing
  2. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  3. Finance and Insurance
    Finance and Insurance
  4. Health Care & Social Assistance
    Health Care & Social Assistance
  5. Transportation & Warehousing
    Transportation & Warehousing
  6. Accommodation & Food Services
    Accommodation & Food Services
  7. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  8. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  9. Construction
    Construction
  10. Educational Services
    Educational Services
  11. Information
    Information
  12. Management of Companies & Enterprises
    Management of Companies & Enterprises
  13. Mining
    Mining
  14. Other Services (except Public Administration)
    Other Services (except Public Administration)
  15. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  16. Public Administration
    Public Administration
  17. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  18. Retail Trade
    Retail Trade
  19. Utilities
    Utilities
  20. Wholesale Trade
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background