F5 BIG-IP Web Management Console CSRF

2009.08.27
Credit: nnposter
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-352


Ogólna skala CVSS: 6.8/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

F5 BIG-IP Web Management Console CSRF Product: F5 BIG-IP http://www.f5.com/products/big-ip/ By design the F5 BIG-IP web management interface allows a logged-in user with Resource Manager or Administrator privileges to execute an arbitrary bigpipe shell command through the web "Console" feature. It is possible to craft URL links that would execute the command with a simple HTTP GET request. Cross-site attacks may leverage this functionality to reconfigure the BIG-IP appliance, including creating new administrators. The vulnerability has been identified in version 9.4.3. However, other versions may be also affected. Solution: Administrators should not browse untrusted sites while logged into the BIG-IP web management interface. It is not possible to log out of the interface so it is important to shut down the browser after the interface is no longer needed. Closing the interface browser window or removing the BIG-IP cookie is not sufficient. Found by: nnposter

Referencje:

http://xforce.iss.net/xforce/xfdb/40419
http://www.securityfocus.com/bid/27720
http://www.securityfocus.com/archive/1/archive/1/487863/100/200/threaded
http://www.securityfocus.com/archive/1/archive/1/487862/100/200/threaded
http://osvdb.org/50985


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top