CVE-2019-5591

What Is Fortinet FortiOS?

FortiOS is the operating system running on Fortinet's FortiGate line of firewalls and SSL VPN appliances, deployed at the network perimeter of businesses and government agencies worldwide to control traffic, enforce security policy, and provide remote-access VPN. Because these appliances often serve as the entire organization's front door and integrate with directory services like LDAP for authentication, weaknesses in how they validate connections to those directory services can undermine authentication security across the whole environment.

Overview

CVE-2019-5591 is a default configuration vulnerability (CWE-306, Missing Authentication for Critical Function) in FortiOS. By default, FortiOS does not adequately validate the identity of the LDAP server it connects to for authentication, allowing an unauthenticated attacker on the same network segment to impersonate the legitimate LDAP server. CVSS score: 6.5 (Attack Vector: Adjacent Network).

Technical Details

When FortiGate is configured to use LDAP for authentication, the default settings do not enforce certificate validation of the LDAP server's identity. An attacker positioned on the same broadcast domain or otherwise able to intercept LDAP traffic (for example, via ARP spoofing or ADJ-network access) can stand up a rogue LDAP server and respond to FortiGate's authentication queries, capturing credentials submitted by users attempting to authenticate through the firewall/VPN. Because this is a default-configuration issue rather than a code-level memory-safety bug, remediation is primarily a configuration change (enforcing server certificate validation) rather than a firmware patch alone.

Discovery

This vulnerability was documented through Fortinet's own advisory process (FortiGuard PSIRT).

Exploitation Context

CVE-2019-5591 gained particular significance as one of several older Fortinet FortiOS vulnerabilities — alongside CVE-2018-13379 (SSL VPN path traversal credential disclosure) and CVE-2020-12812 (SSL VPN 2FA bypass) — that US and international government agencies documented being exploited together by advanced persistent threat actors and ransomware affiliates in joint cybersecurity advisories covering Fortinet-targeted campaigns from 2020 onward. Attackers have used this cluster of Fortinet vulnerabilities to harvest credentials and gain initial network access before deploying ransomware or conducting espionage operations.

Remediation

1. Enable and enforce LDAP server certificate validation in FortiGate's LDAP configuration rather than relying on default settings.
2. Upgrade FortiOS to a version where secure defaults for LDAP validation are enabled out of the box.
3. Segment authentication traffic so that LDAP queries from FortiGate cannot be intercepted or spoofed by an untrusted device on the same network segment.
4. Review authentication logs for anomalies that could indicate credential interception, such as repeated failed logins following successful ones from unexpected sources.
5. Treat this vulnerability as part of a broader Fortinet patching priority — remediate alongside CVE-2018-13379 and CVE-2020-12812, given their documented joint exploitation in real-world intrusions.