FortiClient leaves VPN credentials in memory for DEEPDATA

Volexity reported the discovery of a zero-day vulnerability in FortiClient. The flaw allowed user credentials to remain in the process memory of FortiClient after authentication, making them susceptible to extraction. A plugin of DEEPDATA, a Windows post-exploitation toolkit that Volexity attributes to the China-linked developer BrazenBamboo, reads usernames, passwords, gateways and ports straight out of that memory on FortiClient v7.4.0. Fortinet acknowledged the issue in July, but has not issued a fix, and Volexity is not aware of an assigned CVE. BleepingComputer asked Fortinet about the zero-day and was still waiting for an answer when it published. A detailed analysis by Volexity is available online.