search menu icon-carat-right cmu-wordmark

CERT Coordination Center

F5 BIG-IP contains multiple vulnerabilities including unauthenticated remote command execution

Vulnerability Note VU#290915

Original Release Date: 2020-07-08 | Last Revised: 2020-07-13

Overview

F5 BIG-IP provides a Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that has multiple vulnerabilities including a remotely exploitable command injection vulnerability that can be used to execute arbitrary commands and subsequently take control of a vulnerable system.

Description

F5 BIG-IP devices provide load-balancing capability to application services such as HTTP and DNS. The F5 BIG-IP TMUI management web interface improperly neutralizes untrusted user input and can be abused by unauthenticated remote attackers to perform malicious activities such as cross-site scripting (XSS), cross-site request forgery (CSRF), and command injection CWE-74. F5 has also announced that BIG-IP devices do not properly enforce access controls to sensitive configuration files that be read and overwritten by an authenticated user via Secure Copy (SCP). The vulnerability identified by CVE-2020-0592 can be abused to achieve arbitrary code execution on the target device with root privileges.

Underlying causes and factors in these vulnerabilities include:

F5 recommends that the TMUI web interface should be accessible only from a secure or an out-of-band network and not directly from the Internet (K13092). However, many installations, as observed by Bad Packets, do not seem to follow this recommendation.

Impact

An unauthenticated attacker with network access to the TMUI may be able to execute arbitrary system commands, create or delete files, disable services, and subsequently execute arbitrary code with high privileges such as root. An authenticated user is also be able to perform unexpected activities such as changing configuration files on a vulnerable device.

Solution

Apply updates

F5 has provided updated software for the several impacted versions of BIG-IP devices. Note that BIG-IP appliances as well as virtual instances are also vulnerable as identified by F5 advisories. It is highly recommended that you upgrade to the latest secure and stable software provided by F5. These updates are essential to your device's security, even if the TMUI is not accessible over the Internet. The upgrade reduces the risk to your device being compromised using CSRF or XSS attacks.

Workarounds

In many cases, an attack against BIG-IP's recent vulnerabilities require access to TMUI. Blocking or disabling access to TMUI from untrusted networks is highly recommended. F5 has also provided multiple temporary workaround options in their advisory.

Acknowledgements

Several of these vulnerabilities were reported by Mikhail Klyuchnikov of Positive Technologies, who worked with F5 on a coordinated disclosure.

This document was written by Vijay Sarvepalli.

Vendor Information

290915
 

F5 Networks Inc. Affected

Updated: 2020-07-08

CVE-2020-5902 Affected
CVE-2020-5903 Affected
CVE-2020-5904 Affected
CVE-2020-5905 Affected
CVE-2020-5906 Affected
CVE-2020-5907 Affected
CVE-2020-5908 Affected

Vendor Statement

We have not received a statement from the vendor.

References

CERT Addendum

Please see recent advisories provided by F5 to address these vulnerabilities.


Other Information

CVE IDs: CVE-2020-5902 CVE-2020-5903 CVE-2020-5904 CVE-2020-5905 CVE-2020-5906 CVE-2020-5907 CVE-2020-5908
Date Public: 2020-07-08
Date First Published: 2020-07-08
Date Last Updated: 2020-07-13 14:00 UTC
Document Revision: 2

Sponsored by CISA.