InfoSecBulletin Cybersecurity for mankind
Fortinet warns that a three-year-old vulnerability allows attackers to bypass 2FA on FortiGate firewalls by merely altering the capitalization of usernames.
The vulnerability FG-IR-19-283 (CVE-2020-12812) was reported and fixed in July 2020. Recently, it has been noted that attackers are exploiting this flaw in organizations that haven’t addressed specific configurations.
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Fortinet has observed recent abuse of the July 2020 vulnerability FG-IR-19-283/CVE-2020-12812 in the wild based on specific configurations,” the new analysis warns.
The flaw is a classic logic error born from a discrepancy between how different systems handle text. FortiGate firewalls traditionally treat usernames as case-sensitive (e.g., “User” is different from “user”), while many LDAP directories (like Microsoft Active Directory) treat them as the same.
“This particular authentication behavior is caused by FortiGate treating usernames as case-sensitive by default, when the LDAP Directory does not,” the report explains.
This mismatch creates a security loophole. An organization with a local user using 2FA and a backup LDAP policy allows attackers to bypass the security token.
The exploit is deceptively simple. Imagine a user named jsmith who is protected by a 2FA token.
An attacker tries to log in using VPN or the admin panel with different case variations, like JSmith or JSMITH.
The FortiGate checks its local user database and finds that JSmith is not the same as jsmith due to case sensitivity. As a result, it does not ask for the 2FA token.
The firewall checks secondary authentication methods like LDAP groups. It recognizes JSmith as a valid user because the LDAP server is case-insensitive and grants access based only on the password.
“If the user logs in with ‘Jsmith’, or ‘jSmith’, or ‘JSmith’, or ‘jsmith’ or anything that is NOT an exact case match to ‘jsmith’, the FortiGate will not match the login against the local user,” the report details. “Authentication will be successful regardless of any settings within the local user policy (2FA and disabled accounts)”.
The impact is severe: “This can result in admin or VPN users being authenticated without 2FA”.
Fortinet urges administrators to update their systems to versions 6.0.10, 6.2.4, 6.4.1, or newer.
Organizations that can’t upgrade right away or want to verify their setup can apply a manual fix. Admins can adjust the firewall to disregard case differences, closing the security gap.
“With username-sensitivity set to disabled, FortiGate will treat jsmith, JSmith, JSMITH and all possible combinations as identical and therefore prevent failover to any other misconfigured LDAP group setting,” the report advises.
Administrators should apply the following command to local accounts:
set username-sensitivity disable (for newer versions)
set username-case-sensitivity disable (for older versions)
The report suggests reviewing authentication policies: “Remove unnecessary secondary LDAP Groups” to reduce the attack surface.
