SB2020092501 - MitM attack in Fortinet Forticlient

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper validation of certificate with host mismatch (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform a MitM attack.

The vulnerability exists in FortiClient SSL-VPN client due to the application does not properly validate server certificates and checks only if the certificate was issued by a trusted CA or Fortinet itself. A remote attacker can supply a certificate, issued to a different Fortigate router and perform a Man-in-the-Middle attack.

Successful exploitation of the vulnerability may allow an attacker to intercept and descrypt all traffic, protected with Fortinet SSL-VPN.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://securingsam.com/breaching-the-fort/