CVE-2024-32122
CVE-2024-32122: Fortinet FortiOS stores passwords in a recoverable format, potentially leading to information disclosure. An attacker could modify the LDAP server IP to point to a malicious server, gaining access to sensitive information. With an SVRS of 31, while not critical, CVE-2024-32122 still poses a risk that needs to be addressed. This vulnerability allows for unauthorized access to passwords, which could compromise the entire system. Despite a low CVSS score, the fact that it is tagged "In The Wild" should raise concerns. The ability to retrieve passwords exposes organizations to significant data breaches. It is crucial to apply the necessary patches and security measures to mitigate this risk and protect sensitive user data.
Description
CVE-2024-32122 describes a vulnerability in Fortinet FortiOS versions 7.2.0 through 7.2.1 where passwords are stored in a recoverable format. This allows an attacker, by modifying the LDAP server IP address to point to a malicious server, to potentially gain unauthorized access to sensitive information through information disclosure. The SOCRadar Vulnerability Risk Score (SVRS) is 30, indicating a low risk compared to the CVSS score of 2.3; however, due to the fact the vulnerability is used in the wild, it requires monitoring to ensure the risk remains low for specific use-cases.
Key Insights
- Recoverable Password Storage: The core issue lies in FortiOS storing passwords in a format that can be recovered. This significantly reduces the effort required for an attacker to compromise accounts, making LDAP authentication a potential weak point.
- LDAP Server Hijacking: The vulnerability relies on the attacker's ability to redirect LDAP traffic to a malicious server. This suggests weaknesses in input validation, configuration control, or network security that allow for such redirection.
- In The Wild Exploitation: The vulnerability is actively exploited by hackers, demanding that system administrators take immediate action.
Mitigation Strategies
- Upgrade FortiOS: Upgrade to a patched version of FortiOS that resolves the password storage issue. This is the most direct and effective mitigation.
- Two-Factor Authentication (2FA): Implement 2FA for all user accounts, particularly those with administrative privileges. This provides an additional layer of security even if passwords are compromised.
- Network Segmentation and Monitoring: Implement network segmentation to limit the blast radius of a potential compromise. Monitor network traffic for suspicious LDAP activity, including unauthorized connection attempts or data exfiltration.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.