<<< Date Index >>>     <<< Thread Index >>>

F5 BIG-IP Management Interface Perl Injection



F5 BIG-IP Management Interface Perl Injection


Product: F5 BIG-IP
http://www.f5.com/products/big-ip/


The F5 BIG-IP reconfiguration facility, used by both the web management 
interface and the CLI, suffers from insufficient input validation and/or 
sanitization of certain reconfiguration requests. It is possible for a 
logged-in user with Resource Manager or Administrator privileges to inject 
arbitrary Perl code, including spawning Unix shell commands, that gets 
immediately executed with root privileges. (For the Administrator role this 
does not provide any new privileges because it is already provided with full 
shell access as root.)

The core of the problem is using Perl EP3 with templates containing 
substitutions similar to

    $val='NEW_VALUE';

without first escaping single quotes in NEW_VALUE;

As an example, the SNMP community string configuration accepts the following 
value as an allowed source of SNMP requests:

    "none'.`touch /etc/foo`.'"

It is possible to craft URL links that would inject the code with a simple HTTP 
GET request. Cross-site attacks may leverage this vulnerability to make an 
arbitrary change to the BIG-IP appliance.


The vulnerability has been identified in version 9.4.3. However, other versions 
may be also affected.


Found by:
nnposter