CVE-2021-32600: Fortinet FortiOS Information Disclosure

CVE-2021-32600 Overview

An exposure of sensitive information to an unauthorized actor vulnerability exists in FortiOS CLI that may allow a local and authenticated user assigned to a specific VDOM to retrieve other VDOMs information such as the admin account list and the network interface list. This vulnerability affects FortiOS versions 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x.

Critical Impact

Authenticated local attackers with VDOM access can bypass intended isolation boundaries to access sensitive administrative information from other VDOMs, potentially compromising network segmentation security.

Affected Products

• Fortinet FortiOS 7.0.0
• Fortinet FortiOS 6.4.0 through 6.4.6
• Fortinet FortiOS 6.2.0 through 6.2.9, 6.0.x, and 5.6.x

Discovery Timeline

• 2021-11-17 - CVE-2021-32600 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-32600

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw exists within the FortiOS command-line interface (CLI) and its handling of Virtual Domain (VDOM) isolation boundaries.

FortiOS uses VDOMs to partition a single FortiGate unit into multiple virtual devices, each with its own security policies, routing tables, and administrative access. This vulnerability undermines the security model by allowing authenticated users with access to one VDOM to query and retrieve sensitive information from other VDOMs on the same physical device.

The exposed information includes admin account lists and network interface configurations from other VDOMs, which could be leveraged by an attacker to map out the network architecture and identify potential targets for further attacks.

Root Cause

The root cause of this vulnerability is improper access control enforcement within the FortiOS CLI when processing certain commands. The CLI fails to properly validate that a user's request is limited to their assigned VDOM, allowing cross-VDOM information queries. This represents a breakdown in the VDOM isolation mechanism that organizations rely on for multi-tenant or segmented network deployments.

Attack Vector

The attack requires local access to the FortiGate device CLI and valid authentication credentials for a user assigned to at least one VDOM. The attacker leverages specific CLI commands that bypass VDOM boundary checks to enumerate administrative accounts and network interfaces configured in other VDOMs.

Since this is a local attack vector requiring authentication, exploitation requires either legitimate user credentials or prior compromise of a VDOM administrator account. The vulnerability does not enable direct configuration changes but provides reconnaissance data that could facilitate subsequent attacks.

Detection Methods for CVE-2021-32600

Indicators of Compromise

• Unusual CLI access patterns from VDOM-restricted user accounts
• Log entries showing queries for resources outside the user's assigned VDOM
• Administrative commands executed by users without appropriate VDOM permissions
• Unexpected enumeration of admin accounts or network interfaces across VDOMs

Detection Strategies

• Monitor FortiOS system event logs for CLI commands that access cross-VDOM resources
• Configure alerting for any administrative queries from non-root VDOM accounts
• Implement user behavior analytics to detect anomalous CLI access patterns
• Review audit logs for VDOM boundary violations or permission escalation attempts

Monitoring Recommendations

• Enable comprehensive logging for all CLI sessions and administrative commands
• Configure SIEM integration to correlate FortiOS events with other security telemetry
• Establish baseline behavior for VDOM administrator activities
• Deploy SentinelOne Singularity to monitor for post-exploitation activities on systems connected to affected FortiGate devices

How to Mitigate CVE-2021-32600

Immediate Actions Required

• Upgrade FortiOS to a patched version as recommended by Fortinet
• Review and restrict CLI access to only necessary administrative personnel
• Audit current VDOM user assignments and remove unnecessary access
• Implement the principle of least privilege for all VDOM administrator accounts

Patch Information

Fortinet has released security updates to address this vulnerability. Administrators should upgrade to FortiOS versions that contain the fix as outlined in the FortiGuard Security Advisory FG-IR-20-243. Consult the advisory for specific version recommendations based on your current FortiOS release.

Workarounds

• Restrict CLI access to trusted administrators only until patching is complete
• Implement network segmentation to limit access to FortiGate management interfaces
• Monitor CLI activity closely for signs of exploitation
• Consider disabling unnecessary VDOM configurations where possible

# Configuration example - Restrict CLI access to specific trusted hosts
config system admin
    edit "admin"
        set trusthost1 192.168.1.0 255.255.255.0
        set trusthost2 10.0.0.5 255.255.255.255
    next
end