InfoSecBulletin Cybersecurity for mankind
Fortinet warns that a three-year-old vulnerability allows attackers to bypass 2FA on FortiGate firewalls by merely altering the capitalization of usernames.
The vulnerability FG-IR-19-283 (CVE-2020-12812) was reported and fixed in July 2020. Recently, it has been noted that attackers are exploiting this flaw in organizations that haven’t addressed specific configurations.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“Fortinet has observed recent abuse of the July 2020 vulnerability FG-IR-19-283/CVE-2020-12812 in the wild based on specific configurations,” the new analysis warns.
The flaw is a classic logic error born from a discrepancy between how different systems handle text. FortiGate firewalls traditionally treat usernames as case-sensitive (e.g., “User” is different from “user”), while many LDAP directories (like Microsoft Active Directory) treat them as the same.
“This particular authentication behavior is caused by FortiGate treating usernames as case-sensitive by default, when the LDAP Directory does not,” the report explains.
This mismatch creates a security loophole. An organization with a local user using 2FA and a backup LDAP policy allows attackers to bypass the security token.
The exploit is deceptively simple. Imagine a user named jsmith who is protected by a 2FA token.
An attacker tries to log in using VPN or the admin panel with different case variations, like JSmith or JSMITH.
The FortiGate checks its local user database and finds that JSmith is not the same as jsmith due to case sensitivity. As a result, it does not ask for the 2FA token.
The firewall checks secondary authentication methods like LDAP groups. It recognizes JSmith as a valid user because the LDAP server is case-insensitive and grants access based only on the password.
“If the user logs in with ‘Jsmith’, or ‘jSmith’, or ‘JSmith’, or ‘jsmith’ or anything that is NOT an exact case match to ‘jsmith’, the FortiGate will not match the login against the local user,” the report details. “Authentication will be successful regardless of any settings within the local user policy (2FA and disabled accounts)”.
The impact is severe: “This can result in admin or VPN users being authenticated without 2FA”.
Fortinet urges administrators to update their systems to versions 6.0.10, 6.2.4, 6.4.1, or newer.
Organizations that can’t upgrade right away or want to verify their setup can apply a manual fix. Admins can adjust the firewall to disregard case differences, closing the security gap.
“With username-sensitivity set to disabled, FortiGate will treat jsmith, JSmith, JSMITH and all possible combinations as identical and therefore prevent failover to any other misconfigured LDAP group setting,” the report advises.
Administrators should apply the following command to local accounts:
set username-sensitivity disable (for newer versions)
set username-case-sensitivity disable (for older versions)
The report suggests reviewing authentication policies: “Remove unnecessary secondary LDAP Groups” to reduce the attack surface.
