CVE-2021-36166
📋 TL;DR
This vulnerability allows remote attackers to efficiently guess administrative authentication tokens in FortiMail systems by observing certain system properties. It affects FortiMail versions before 7.0.1, potentially enabling unauthorized administrative access.
💻 Affected Systems
- FortiMail
📦 What is this software?
Fortimail by Fortinet
Fortimail by Fortinet
Fortimail by Fortinet
Fortimail by Fortinet
Fortimail by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the FortiMail system, allowing attackers to read/modify emails, reconfigure security settings, and potentially pivot to internal networks.
Likely Case
Unauthorized administrative access leading to email interception, configuration changes, and potential data exfiltration.
If Mitigated
Limited impact if strong network segmentation and monitoring are in place, though authentication bypass remains possible.
🎯 Exploit Status
The vulnerability allows efficient token guessing through observable system properties, making exploitation straightforward once understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.1 and later
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-21-028
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download FortiMail 7.0.1 or later from Fortinet support portal. 3. Upload and install the firmware update via web interface or CLI. 4. Reboot the system. 5. Verify successful upgrade and functionality.
🔧 Temporary Workarounds
Restrict Administrative Access
allLimit administrative interface access to trusted IP addresses only
config system interface
edit <interface_name>
set allowaccess https ssh
set trust-ip-1 <trusted_ip>
end
Enable Multi-Factor Authentication
allRequire additional authentication factors for administrative access
config system admin
edit <admin_user>
set two-factor enable
set two-factor-method fortitoken
end
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FortiMail from untrusted networks
- Enable comprehensive logging and monitoring for authentication attempts and administrative actions
🔍 How to Verify
Check if Vulnerable:
Check FortiMail version via web interface (System > Dashboard) or CLI command: get system statusCheck Version:
get system status | grep VersionVerify Fix Applied:
Confirm version is 7.0.1 or higher using: get system status | grep Version📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from single source
- Successful administrative login from unusual IP addresses
- Configuration changes from unexpected sources
Network Indicators:
- Unusual traffic patterns to administrative interfaces
- Authentication requests from external IPs if restricted
SIEM Query:
source="fortimail" (event_type="admin_login" OR event_type="auth_failure") | stats count by src_ip