CVE-2019-6693 PoC — Fortinet FortiOS 信任管理问题漏洞

Source

https://github.com/gquere/CVE-2019-6693

Associated Vulnerability

Title:Fortinet FortiOS 信任管理问题漏洞 (CVE-2019-6693)
Description:Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

Description

Decrypt FortiGate configuration secrets

Readme

# CVE-2019-6693
Decrypt FortiGate configuration secrets

[Original advisory](https://medium.com/@bart.dopheide/decrypting-fortigate-passwords-cve-2019-6693-1239f6fd5a61)
[Vendor advisory](https://www.fortiguard.com/psirt/FG-IR-19-007)

For Fortigate VM/appliances below versions 6.2.0, 6.0.0 to 6.0.6, 5.6.10 configuration secrets are stored encrypted with a unique key.
For versions above the non-default ```private-data-encryption``` parameter lets the user use a custom key. This is rarely used, even today.

This [script](./fortigate_decrypt.py) decrypts secrets from dumped configurations.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!