Kemp Load Balancer up to 7.2.40.0 Web Application Firewall HTTP POST Request 7pk security

Summaryinfo

A vulnerability marked as critical has been reported in Kemp Load Balancer up to 7.2.40.0. Affected by this issue is some unknown functionality of the component Web Application Firewall. Performing a manipulation as part of HTTP POST Request results in 7pk security. This vulnerability was named CVE-2017-15524. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Kemp Load Balancer up to 7.2.40.0. This affects an unknown code of the component Web Application Firewall. The manipulation as part of a HTTP POST Request leads to a 7pk security vulnerability. CWE is classifying the issue as CWE-254. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Feature Bypass via an HTTP POST request.

The bug was discovered 12/14/2017. The weakness was presented 12/19/2017 as not defined posting (Bugtraq). The advisory is shared at securityfocus.com. This vulnerability is uniquely identified as CVE-2017-15524 since 10/17/2017. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1211 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 7.2.40.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Kemp

Name

• Load Balancer

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.9
• 7.2.10
• 7.2.11
• 7.2.12
• 7.2.13
• 7.2.14
• 7.2.15
• 7.2.16
• 7.2.17
• 7.2.18
• 7.2.19
• 7.2.20
• 7.2.21
• 7.2.22
• 7.2.23
• 7.2.24
• 7.2.25
• 7.2.26
• 7.2.27
• 7.2.28
• 7.2.29
• 7.2.30
• 7.2.31
• 7.2.32
• 7.2.33
• 7.2.34
• 7.2.35
• 7.2.36
• 7.2.37
• 7.2.38
• 7.2.39
• 7.2.40.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion