PSIRT Advisory

Multiple VPN applications insecurely store session cookies

Summary

The Missing Encryption Of Sensitive Data vulnerability in FortiClient may allow an attacker to access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only if endpoint device has been compromised in such a way that the attacker has access to FortiClient's debug logs or memory space. Furthermore,  practical use of the stolen cookie requires the attacker to spoof the endpoint's IP address.

Impact

Exploiting the stolen session cookie may consist in an attacker replaying the cookie and gain access to user's VPN session or loging out the user itself

Affected Products

FortiClient for Windows (6.2.0 and earlier)
FortiClient for Mac OSX (6.2.0 and earlier)

Solutions

Fortigate by default mitigates the session cookie misuse by verifying the source IP of client's request. As a precautionary measure, please upgrade to upcoming:
FortiClient for Windows 6.2.1
FortiClient for Mac OSX 6.2.1