F5 BIG-IP up to 14.0.0.2 Appliance Mode access control

Summaryinfo

A vulnerability identified as critical has been detected in F5 BIG-IP up to 11.5.6/11.6.3.2/12.1.3.5/13.1.0.5/14.0.0.2. This affects an unknown part of the component Appliance Mode. The manipulation leads to access control. This vulnerability is traded as CVE-2018-15321. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in F5 BIG-IP up to 11.5.6/11.6.3.2/12.1.3.5/13.1.0.5/14.0.0.2 (Firewall Software). It has been rated as critical. This issue affects some unknown functionality of the component Appliance Mode. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

When BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.2.1-11.5.6, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, iWorkflow 2.1.0-2.3.0, or Enterprise Manager 3.1.1 is licensed for Appliance Mode, Admin and Resource administrator roles can by-pass BIG-IP Appliance Mode restrictions to overwrite critical system files. Attackers of high privilege level are able to overwrite critical system files which bypasses security controls in place to limit TMSH commands. This is possible with an administrator or resource administrator roles when granted TMSH. Resource administrator roles must have TMSH access in order to perform this attack.

The bug was discovered 10/31/2018. The weakness was shared 10/30/2018 (Website). It is possible to read the advisory at support.f5.com. The identification of this vulnerability is CVE-2018-15321 since 08/14/2018. The exploitation is known to be easy. The attack may be initiated remotely. A simple authentication is required for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 118615 (F5 Networks BIG-IP : BIG-IP tmsh vulnerability (K01067037)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family F5 Networks Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371352 (F5 BIG-IP ASM,LTM,APM tmsh shell Critical System Files Unauthorized ModificationShell Vulnerability (K01067037)).

Upgrading eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (118615). The entries VDB-126363, VDB-126361, VDB-126360 and VDB-126358 are related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

Version

• 11.5.0
• 11.5.1
• 11.5.2
• 11.5.3
• 11.5.4
• 11.5.5
• 11.5.6
• 11.6.3.0
• 11.6.3.1
• 11.6.3.2
• 12.1.3.0
• 12.1.3.1
• 12.1.3.2
• 12.1.3.3
• 12.1.3.4
• 12.1.3.5
• 13.1.0.0
• 13.1.0.1
• 13.1.0.2
• 13.1.0.3
• 13.1.0.4
• 13.1.0.5
• 14.0.0.0
• 14.0.0.1
• 14.0.0.2

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion