F5 BIG-IP APM up to 11.2.1/11.4.x/11.5.x/11.6.0 HF5 SSO_ORIG_URI redirect

Summaryinfo

A vulnerability, which was classified as critical, has been found in F5 BIG-IP APM up to 11.2.1/11.4.x/11.5.x/11.6.0 HF5. Affected is an unknown function. The manipulation of the argument SSO_ORIG_URI leads to redirect. This vulnerability is uniquely identified as CVE-2016-3687. The attack is possible to be carried out remotely. No exploit exists. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in F5 BIG-IP APM up to 11.2.1/11.4.x/11.5.x/11.6.0 HF5 (Firewall Software). This issue affects an unknown functionality. The manipulation of the argument SSO_ORIG_URI with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge Gateway 11.2.1, when using multi-domain single sign-on (SSO), allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in the SSO_ORIG_URI parameter.

The weakness was disclosed 06/16/2016 (Website). The advisory is shared at support.f5.com. The identification of this vulnerability is CVE-2016-3687 since 03/29/2016. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 91580 (F5 Networks BIG-IP : BIG-IP APM SSO vulnerability (K26738102)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family F5 Networks Local Security Checks and running in the context l.

Applying the patch 11.6.0 HF6 is able to eliminate this problem. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (91580). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP APM

Version

• 11.0
• 11.1
• 11.2
• 11.2.0
• 11.2.1
• 11.3
• 11.4
• 11.5
• 11.6.0 HF5

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion