F-Secure warns of F5 Big IP-related security issue

Security firm F-Secure has issued a warning about security issues in some common configurations for F5 Networks’ Big-IP load balancer.

According to the security firm’s researchers, unless addressed, the issues could lead to cyber attacks on government departments, banks and large enterprises, where the device is widely deployed.

Adversaries can exploit insecurely configured load balancers to penetrate networks and perform a wide variety of attacks using web services managed by a compromised device, F-Secure warns.

The security issue relates to coding practices in the programming language tool command language (Tcl) used for Big-IP’s iRules, which direct incoming web traffic. Certain coding practices, the researchers said, allow attackers to inject arbitrary Tcl commands “which could be executed in the security context of the target Tcl script”.

Adversaries that successfully exploit insecurely configured iRules can use the compromised Big-IP device as a beachhead to launch further attacks, the researchers said, resulting in a potentially severe breach for an organisation.

Attackers could also intercept and manipulate web traffic, leading to the exposure of sensitive information, including authentication credentials and application secrets, as well as allowing the users of an organisation’s web services to be targeted.

In some cases, the researchers said exploiting a vulnerable system can be as simple as submitting a command or piece of code as part of a web request, that the technology will execute for the attacker.

There are even cases where the compromised device will not record the adversaries’ actions, meaning there would be no evidence that an attack took place, the researchers warn. In other cases, an attacker could delete logs that contain evidence of their post-exploit activities.  

F5 has issued a statement, making it clear that the vulnerability is not in Tcl or F5 products, but an issue relating to coding practices used in creating scripts.

“As with most programming or scripting languages, it is possible to write code in a way that creates vulnerabilities,” the statement said.

“We have been working with the researcher on documentation and notification to ensure customers can evaluate their exposure and take necessary steps to mitigate.

“The best practice for Tcl scripting is to escape all expressions, ensuring they are not substituted or evaluated unexpectedly. Customers are advised to evaluate Tcl scripts and make all changes they deem appropriate under this guidance.”

F-Secure senior security consultant Christoffer Jerkeby, who discovered the issue, said: “This configuration issue is really quite severe because it’s stealthy enough for an attacker to get in, achieve a wide variety of objectives, and then cover their tracks.

“In addition, many organisations aren’t prepared to find or fix issues that are buried deep in software supply chains, which adds up to a potentially big security problem. Unless you know what to look for, it’s tough to foresee this problem occurring, and even harder to deal with in an actual attack,” he said.