CVE-2019-5591
MEDIUM KEV RANSOMWARE NUCLEIFortiOS < 6.2.0 - Unauthenticated Sensitive Information Interception via LDAP Server Impersonation
Title source: llmExploitation Summary
CVE-2019-5591 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 1 public exploit from researchers including ayewo. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC demonstrates a MITM attack against FortiOS LDAP authentication by impersonating an LDAP server to capture credentials. It includes a Python-based LDAP honeypot that logs BIND and SEARCH requests, extracting and exfiltrating credentials.
Description
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
Exploits (1)
This PoC demonstrates a MITM attack against FortiOS LDAP authentication by impersonating an LDAP server to capture credentials. It includes a Python-based LDAP honeypot that logs BIND and SEARCH requests, extracting and exfiltrating credentials.
Nuclei Templates (1)
cpe:"cpe:2.3:o:fortinet:fortios"
References (2)
Scores
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N