CVE-2018-13374

What is FortiOS / FortiADC?

FortiOS is the operating system running Fortinet's FortiGate firewall and VPN appliances, and FortiADC is Fortinet's application delivery controller (load balancer). Both integrate with enterprise directory services (LDAP/Active Directory) so that firewall and VPN access decisions can be tied to centralized user accounts. Because these appliances sit at the network perimeter and hold configured credentials for the organization's identity infrastructure, a flaw that exposes those credentials threatens the directory service itself, not just the appliance.

Overview

CVE-2018-13374 is an improper access control vulnerability in the LDAP "connectivity test" feature of FortiOS and FortiADC's admin interface. This feature lets an administrator verify that the appliance can reach a configured LDAP server, but it does not adequately validate that the test target matches the originally configured server — an attacker with sufficient access to the test function can redirect it to a server they control and capture the credentials the appliance sends during the connection attempt.

Technical Details

The flaw (CWE-732, Incorrect Permission Assignment for Critical Resource — reflecting the underlying trust/authorization gap in the test workflow) allows a low-privileged authenticated user to specify an arbitrary LDAP server address for the connectivity test. Because the appliance authenticates to whatever server is specified using the credentials already stored in its configuration, pointing the test at an attacker-controlled LDAP listener causes the device to hand over the plaintext (or otherwise recoverable) bind credentials for the organization's real directory service. The impact is confidentiality-only (CVSS 4.3) since the attack discloses credentials rather than directly compromising the appliance, but those credentials can then be used to pivot into Active Directory or LDAP directly.

Discovery

The vulnerability was identified and disclosed by Fortinet's own PSIRT process and documented in advisory FG-IR-18-157, alongside the vendor-supplied fix.

Exploitation Context

CISA's KEV entry confirms this vulnerability has been exploited in the wild; its ransomware-use flag reflects its utility as a credential-harvesting step in intrusion chains against Fortinet-protected networks — captured directory credentials can be reused for lateral movement well beyond the FortiGate appliance itself.

Remediation

1. Apply the Fortinet-supplied patch referenced in FG-IR-18-157 for your FortiOS or FortiADC version.
2. Restrict which administrative accounts can access the LDAP connectivity-test feature, following least-privilege principles.
3. Rotate LDAP/directory service credentials configured on any FortiGate or FortiADC appliance that was running a vulnerable version.
4. Monitor directory service authentication logs for unexpected bind attempts originating from unfamiliar hosts using the appliance's service account.
5. Restrict outbound LDAP connectivity from the appliance to only the legitimate, allow-listed directory server addresses.