Serious Vulnerabilities in F5's BIG-IP Allow Full System Compromise

guest · Jul 2, 2020

Serious Vulnerabilities in F5's BIG-IP Allow Full System Compromise
July 2, 2020
https://www.securityweek.com/serious-vulnerabilities-f5s-big-ip-allow-full-system-compromise

Critical and high-severity vulnerabilities discovered by researchers in F5 Networks’ BIG-IP application delivery controller (ADC) allow a remote attacker to take complete control of the targeted system.

The vulnerabilities were identified by researchers at cybersecurity firm Positive Technologies, which disclosed its findings this week after the vendor released advisories and announced the availability of patches.

The critical vulnerability discovered by Positive Technologies, tracked as CVE-2020-5902 with a CVSS score of 10, allows arbitrary code execution and it can be exploited remotely. The security firm says it has identified more than 8,000 vulnerable devices that are exposed directly to the internet, including 40% in the United States, 16% in China and 3% in Taiwan.
However, it noted that most companies using the impacted product do not allow access to the vulnerable configuration interface directly from the internet.
Click to expand...

According to F5, the vulnerability affects a configuration utility named Traffic Management User Interface (TMUI). The vendor has confirmed that exploitation can result in “complete system compromise.”

“By exploiting this vulnerability, a remote attacker with access to the BIG-IP configuration utility could, without authorization, perform remote code execution,” explained Positive Technologies researcher Mikhail Klyuchnikov.
“An attacker can exploit this vulnerability to run JavaScript in the context of the currently logged-in user. In the case of an administrative user with access to the Advanced Shell (bash), successful exploitation of this vulnerability can be leveraged to completely compromise the BIG-IP system through Remote Code Execution,” F5 said in its advisory.
Click to expand...

Positive Technologies: F5 fixes critical vulnerability discovered by Positive Technologies in BIG-IP application delivery controller

Positive Technologies expert Mikhail Klyuchnikov has discovered a vulnerability in the configuration interface of the BIG-IP application delivery controller (ADC) used by some of the world's biggest companies. Attackers can run commands as an unauthorized user and completely compromise a system, including interception of controller application traffic. The vulnerability can be exploited remotely.
Click to expand...

Minimalist · Jul 4, 2020

US Cyber Command urges F5 customers to patch critical BIG-IP flaw

US Cyber Command also urged F5 customers to urgently patch their devices tweeting that "patching CVE-2020-5902 and 5903 should not be postponed over the weekend. Remediate immediately."
Click to expand...

https://www.bleepingcomputer.com/ne...s-f5-customers-to-patch-critical-big-ip-flaw/

guest · Jul 5, 2020

PoC exploits released for F5 BIG-IP vulnerabilities, patch now!
July 5, 2020
https://www.bleepingcomputer.com/ne...ased-for-f5-big-ip-vulnerabilities-patch-now/

Two days after patches for critical F5 BIG-IP vulnerability were released, security researchers have started publicly posting proof-of-concept (PoC) exploits show how easy it is to exploit these devices.

On Friday, F5 disclosed that they released patches for a critical 10/10 CVSSv3 rating vulnerability tracked as CVE-2020-5902.
Exploiting a BIG-IP device would allow an attacker to gain full access to the system, export user credentials, and potentially traverse the device's internal network. [...] F5's advisory [...]
F5 BIG-IP PoC exploits released and actively used
Today, numerous researchers have started to publicly post exploits for the F5 BIG-IP CVE-2020-5902 vulnerability to illustrate how easy it is to exfiltrate data and execute commands on vulnerable devices.
Click to expand...

Another researcher has created a GitHub repository that lists PoCs to perform various tasks such as displaying the /etc/passwd file to access stored credentials or to view the device's configuration file.
NCC Group's Rich Warren has already started to see remote attacks attempting to exploit F5 BIG-IP devices.
Click to expand...

guest · Jul 8, 2020

Mitigating critical F5 BIG-IP RCE flaw not enough, bypass found
July 7, 2020
https://www.bleepingcomputer.com/ne...l-f5-big-ip-rce-flaw-not-enough-bypass-found/

F5 BIG-IP customers who only applied recommended mitigations and haven't yet patched their devices against the unauthenticated remote code execution (RCE) CVE-2020-5902 vulnerability are now advised to update them against a recently found bypass.

F5 addressed the critical 10/10 CVSSv3 rating CVE-2020-5902 security flaw found in BIG-IP ADC's Traffic Management User Interface (TMUI) on July 3rd and recommended mitigations for customers who couldn't immediately patch.
Click to expand...

Bypass negates recommended mitigation
Today, security researchers Chase Dardaman and Rich Mirch with CriticalStart's TeamAres found a bypass that allows exploitation of devices where the mitigation measures were implemented.

At the moment, the researchers are working with F5's Security Incident Response Team (SIRT) to update the company's CVE-2020-5902 security advisory with mitigation information that should also block future attacks potentially using the bypass.
As Mirch told BleepingComputer, BIG-IP customers are advised to add this in addition to F5’s mitigations to fully mitigate.
Click to expand...

guest · Jul 8, 2020

Attackers target critical flaw in popular networking gear
July 7, 2020
https://www.welivesecurity.com/2020...itical-vulnerability-popular-networking-gear/

F5 Networks, one of the world’s leading providers of enterprise networking equipment, has recently published a security advisory about a critical vulnerability that impacts its BIG-IP multi-purpose networking devices and “may result in complete system compromise”. The company has also released a patch plugging the security hole, [...]

Klyuchnikov also uncovered another, though less severe, vulnerability in BIG-IP that earned a severity score of “only” 7.5. Tracked as CVE-2020-5903, the cross-site scripting vulnerability in the BIG-IP configuration interface could allow a cybercriminal to run malicious code with the same rights as a logged-in user. Successful exploitation of the flaw could even lead to a full compromise of the device.
Click to expand...

At the time of the warning, a Shodan search turned up more than 8,000 BIG-IP devices connected to the internet. If your company uses any of the affected devices, you should patch them immediately. F5’s security advisories for both CVE-2020-5902 and CVE-2020-5903 feature the full list of affected devices and remediation steps.
Click to expand...

guest · Jul 8, 2020

F5 BIG-IP contains multiple vulnerabilities including unauthenticated remote command execution
Vulnerability Note VU#290915
July 8, 2020
https://kb.cert.org/vuls/id/290915

Overview
F5 BIG-IP provides a Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that has multiple vulnerabilities including a remotely exploitable command injection vulnerability that can be used to execute arbitrary commands and subsequently take control of a vulnerable system.
Impact
An unauthenticated attacker with network access to the TMUI may be able to execute arbitrary system commands, create or delete files, disable services, and subsequently execute arbitrary code with high privileges such as root. An authenticated user is also be able to perform unexpected activities such as changing configuration files on a vulnerable device.
Workarounds
In many cases, an attack against BIG-IP's recent vulnerabilities require access to TMUI. Blocking or disabling access to TMUI from untrusted networks is highly recommended. F5 has also provided multiple temporary workaround options in their advisory.
Click to expand...

guest · Jul 18, 2020

Thousands of Vulnerable F5 BIG-IP Users Still Open to Takeover
July 17, 2020
https://threatpost.com/thousands-f5-big-ip-users-takeover/157543/

About 8,000 users of F5 Networks’ BIG-IP family of networking devices are still vulnerable to full system access and remote code-execution (RCE), despite a patch for a critical flaw being available for two weeks.

“CVE-2020-5902 received the highest vulnerability rating of critical from the National Vulnerability Database due to its lack of complexity, ease of attack vector, and high impacts to confidentiality, integrity and availability,” Expanse researchers noted in an advisory issued on Friday.
“It was deemed so critical that U.S. Cyber Command issued a tweet on the afternoon of July 3 [...]

Fast-forward to two weeks later, and patches have rolled out to less than 500 of that original group of vulnerable machines, according to the analysis. Expanse researchers said that as of July 15, there were at least 8,041 vulnerable TMUI instances still exposed to the public internet.
Click to expand...

guest · Jul 24, 2020

US govt confirms active exploitation of F5 BIG-IP RCE flaw
July 24, 2020
https://www.bleepingcomputer.com/ne...ms-active-exploitation-of-f5-big-ip-rce-flaw/

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) today published a warning confirming the active exploitation of the unauthenticated remote code execution (RCE) CVE-2020-5902 vulnerability affecting F5 Big-IP ADC devices.
Two orgs compromised after CVE-2020-5902 exploitation
According to F5's security advisory, any remaining unpatched devices are probably already compromised during attacks that started just a few days after the company disclosed the security flaw.

"CISA has observed scanning and reconnaissance, as well as confirmed compromises, within a few days of F5’s patch release for this vulnerability," the agency says.
Detection and recovery measures
IT admins are advised to use F5's CVE-2020-5902 IoC Detection Tool to look for indicators of compromise within their organizations' environment.
Click to expand...

guest · Aug 16, 2020

FBI: Iranian hackers trying to exploit critical F5 BIG-IP flaw
August 8, 2020
https://www.bleepingcomputer.com/ne...rs-trying-to-exploit-critical-f5-big-ip-flaw/

The FBI warns of Iranian hackers actively attempting to exploit an unauthenticated remote code execution flaw affecting F5 Big-IP application delivery controller (ADC) devices used by Fortune 500 firms, government agencies, and banks.

F5 Networks (F5) released security updates to fix the critical 10/10 CVSSv3 rating F5 Big-IP ADC vulnerability tracked as CVE-2020-5902 on July 3, 2020.
The U.S. domestic intelligence and security service says in a Private Industry Notification (PIN) issued earlier this week that the Iran-sponsored hacking group has been trying to compromise vulnerable Big-IP ADC devices since early July 2020.
Click to expand...

The FBI PIN was issued due to the agency's analysis of the group's previous activity which points at future aggressive campaigns to exploit the CVE-2020-5902 vulnerability before organizations will be able to patch vulnerable F5 Big-IP ADC devices.
The FBI PIN also provides indicators of compromise (IOCs) and Tactics, Techniques and Procedures (TTPs) to allow private industry orgs to identify signs of related malicious activity on their networks.
Click to expand...

ZDNet: FBI says an Iranian hacking group is attacking F5 networking devices

Sources: Attacks linked to a hacker group known as Fox Kitten (or Parisite), considered Iran's "spear tip" when it comes to cyber-attacks
Click to expand...

guest · Sep 1, 2020

Iranian Hackers Target Critical Vulnerability in F5's BIG-IP
September 1, 2020
https://www.securityweek.com/iranian-hackers-target-critical-vulnerability-f5s-big-ip

A hacking group believed to be linked to the Iranian government was observed targeting a critical vulnerability that F5 Networks addressed in its BIG-IP application delivery controller (ADC) in early July.

Tracked as CVE-2020-5902 and featuring a CVSS score of 10, the vulnerability allows remote attackers to take complete control of a targeted system. F5's BIG-IP is used by many large organizations for application acceleration, load balancing, SSL offloading, and web application firewall.
One threat group targeting the vulnerability, Crowdstrike notes in a blog post, is PIONEER KITTEN, an Iran-based cyber-espionage group believed to be “a contract element operating in support of the Iranian government.”

“The widespread nature of PIONEER KITTEN’s target scope is likely a result of the adversary’s opportunistic operational model; the entities apparently of most interest to the adversary are technology, government, defense, and healthcare organizations,” Crowdstrike says.
Click to expand...

Crowdstrike: Who Is PIONEER KITTEN?

PIONEER KITTEN is an Iran-based adversary that has been active since at least 2017 and has a suspected nexus to the Iranian government.
The adversary is particularly interested in exploits related to VPNs and network appliances, including CVE-2019-11510, CVE-2019-19781, and most recently CVE-2020-5902; reliance on exploits such as these lends to an opportunistic operational model.
Click to expand...

guest · Dec 18, 2020

F5 warns over ‘critical’ XSS flaw in BIG-IP
December 17, 2020
https://portswigger.net/daily-swig/f5-warns-over-critical-xss-flaw-in-big-ip

Network security appliance firm F5 has warned of a series of vulnerabilities affecting its BIG-IP products, including a cross-site scripting (XSS) vulnerability that’s said to pose a critical risk.
The vulnerability (CVE-2020-5948) means that “undisclosed endpoints in iControl REST allow for a reflected XSS attack”.

Prompt triage is recommended because failure to patch could result in “complete compromise of the BIG-IP system if the victim user is granted the admin role” and in the event of a successful attack.
Multiple BIG-IP versions are affected. Users need to update to branch versions
13.1.3.5, 14.1.2.8, 15.1.1 or 16.0.1 (as appropriate), as explained in an advisory from F5.
Click to expand...

NVD gave the flaw a CVSSv3 score of 9.6, or critical - a rating F5 disputes.
An engineering representative from F5 told The Daily Swig:

“We don’t know why NVD thinks this is a critical. F5 does not consider it to be, we scored it as a 7.5 high.”
Click to expand...

Another set of patches, also released by F5, address a denial-of-service risk to File Transfer Protocol (FTP) channel. [...]
Click to expand...

guest · Jan 16, 2021

Expert discovered a DoS vulnerability in F5 BIG-IP systems
January 14, 2021
https://securityaffairs.co/wordpress/113440/security/f5-big-ip-dos.html

The security expert Nikita Abramov from Positive Technologies discovered a DoS vulnerability, tracked as CVE-2020-27716, that affects certain versions of F5 BIG-IP Access Policy Manager (APM).

The vulnerability resides in the Traffic Management Microkernel (TMM) component which processes all load-balanced traffic on BIG-IP devices.

“When a BIG-IP APM virtual server processes traffic of an undisclosed nature, the Traffic Management Microkernel (TMM) stops responding and restarts. (CVE-2020-27716)” reads the advisory published by F5. “Traffic processing is disrupted while TMM restarts. If the affected BIG-IP system is configured as part of a device group, the system triggers a failover to the peer device.”
An attacker could trigger the flaw by simply sending a specially crafted HTTP request to the server hosting the BIG-IP configuration utility, and that would be enough to block access to the controller for a while (until it automatically restarts).
Click to expand...

guest · Aug 26, 2021

Critical F5 BIG-IP bug impacts customers in sensitive sectors
F5 Releases Critical Security Patches for BIG-IP and BIG-IQ Devices
August 25, 2021
https://www.bleepingcomputer.com/ne...p-bug-impacts-customers-in-sensitive-sectors/

BIG-IP application services company F5 has fixed more than a dozen high-severity vulnerabilities in its networking device, one of them being elevated to critical severity under specific conditions.

The issues are part of this month’s delivery of security updates, which addresses almost 30 vulnerabilities for multiple F5 devices.
Critical bug for sensitive sectors
Of the thirteen high-severity flaws that F5 fixed, one becomes critical in a configuration “designed to meet the needs of customers in especially sensitive sectors” and could lead to complete system compromise.
Click to expand...

The issue is now tracked as CVE-2021-23031 and affects BIG-IP modules Advanced WAF (Web Application Firewall) and the Application Security Manager (ASM), specifically the Traffic Management User Interface (TMUI).

Normally, it is a privilege escalation with an 8.8 severity score that can be exploited by an authenticated attacker with access to the Configuration utility to run arbitrary system commands, which could lead to complete system compromise.
For customers using the Appliance Mode, which applies some technical restrictions, the same vulnerability comes with a critical rating of 9.9 out of 10.
Click to expand...

F5’s security advisory for CVE-2021-23031 does not provide many details on why there are two severity ratings, but notes that there is a “limited number of customers” that are impacted by the critical variant of the bug unless they install the updated version or apply mitigations.
Click to expand...

guest · Feb 2, 2023

New Flaw in F5 BIG-IP Emerges
By Dennis Fisher @DennisF - February 1, 2023

Several versions of F5’s BIG-IP security appliances have a format string vulnerability that a remote attacker could exploit to either crash the device or potentially achieve arbitrary code execution.
Click to expand...

A researcher at Rapid7 discovered the vulnerability (CVE-2023-22374) in December and reported it to F5, which published an advisory on it Wednesday. However, F5 has not released updates for the affected versions, but released a hotfix instead. Rapid7 published a detailed analysis of the vulnerability, as well, and said that while the bug affects many versions of BIG-IP, it is not simple to exploit.

“The specific issue we discovered is an authenticated format string vulnerability in the SOAP interface (iControlPortal.cgi), which runs as root and requires an administrative login to access. By inserting format string specifiers (such as %s or %n) into certain GET parameters, an attacker can cause the service to read and write memory addresses that are referenced from the stack,” Ron Bowes of Rapid7, who discovered the flaw, said in the analysis.
Click to expand...

The vulnerability affects various versions of BIG-IP 13.x, 14.x, 15.x, 16.x, and 17.x, and F5 has not disclosed whether it will be releasing updated software beyond the engineering hotfixes to address it.
Click to expand...

Log in or Sign up

Serious Vulnerabilities in F5's BIG-IP Allow Full System Compromise

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Serious Vulnerabilities in F5's BIG-IP Allow Full System Compromise

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches