{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/290915#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nF5 BIG-IP provides a Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that has multiple vulnerabilities including a remotely exploitable [command injection](https://cwe.mitre.org/data/definitions/74.html) vulnerability that can be used to execute arbitrary commands and subsequently take control of a vulnerable system.\r\n\r\n### Description\r\nF5 BIG-IP devices provide load-balancing capability to application services such as HTTP and DNS. The F5 BIG-IP TMUI management web interface improperly neutralizes untrusted user input and can be abused by unauthenticated remote attackers to perform malicious activities such as cross-site scripting (XSS), cross-site request forgery (CSRF), and command injection [CWE-74](https://cwe.mitre.org/data/definitions/74.html). F5 has also announced that BIG-IP devices do not properly enforce access controls to sensitive configuration files that be read and overwritten by an authenticated user via Secure Copy (SCP). The vulnerability identified by CVE-2020-0592 can be abused to achieve arbitrary code execution on the target device with root privileges.\r\n\r\nUnderlying causes and factors in these vulnerabilities include:\r\n\r\n*  Improper configuration and a lack of identify checks, see recent article from NCC Group. [Understanding the root cause of F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902](https://research.nccgroup.com/2020/07/12/understanding-the-root-cause-of-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902/)\r\n*  The TMUI fails to enforce proper authentication and authorization, see [OWASP Recommendations](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Testing_Automation_Cheat_Sheet.html)\r\n* The TMUI web interface does not normalize user's input to prevent both XSS and CSRF, allowing a [\"Deadly Combinations of XSS and CSRF\"](https://owasp.org/www-pdf-archive/OTD2011-SK.pdf)\r\n* Lack of role-based access checks allows for for unexpected file access, see [Role-Based Access Control Models](https://csrc.nist.gov/CSRC/media/Projects/Role-Based-Access-Control/documents/sandhu96.pdf)\r\n\r\nF5 recommends that the TMUI web interface should be accessible only from a secure or an out-of-band network and not directly from the Internet ([K13092](https://support.f5.com/csp/article/K13092)). However, many installations, as observed by [Bad Packets](https://badpackets.net/over-3000-f5-big-ip-endpoints-vulnerable-to-cve-2020-5902/), do not seem to follow this recommendation.\r\n\r\n### Impact\r\nAn unauthenticated attacker with network access to the TMUI may be able to execute arbitrary system commands, create or delete files, disable services, and subsequently execute arbitrary code with high privileges such as root. An authenticated user is also be able to perform unexpected activities such as changing configuration files on a vulnerable device.\r\n\r\n### Solution\r\n#### Apply updates\r\nF5 has provided updated software for the several impacted versions of BIG-IP devices.  Note that BIG-IP appliances as well as virtual instances are also vulnerable as identified by F5 advisories. It is highly recommended that you upgrade to the latest secure and stable software provided by F5. These updates are essential to your device's security, even if the TMUI is not accessible over the Internet. The upgrade reduces the risk to your device being compromised using CSRF or XSS attacks.\r\n\r\n#### Workarounds\r\nIn many cases, an attack against BIG-IP's recent vulnerabilities require access to TMUI.  Blocking or disabling access to TMUI from untrusted networks is highly recommended. F5 has also provided multiple temporary workaround options in their advisory.\r\n\r\n### Acknowledgements\r\nSeveral of these vulnerabilities were reported by Mikhail Klyuchnikov of Positive Technologies, who worked with F5 on a coordinated disclosure.\r\n\r\nThis document was written by Vijay Sarvepalli.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"},{"category":"other","text":"Please see recent advisories provided by F5 to address these vulnerabilities.","title":"CERT/CC comment on F5 Networks Inc. notes"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/290915"},{"url":"https://support.f5.com/csp/article/K52145254","summary":"https://support.f5.com/csp/article/K52145254"},{"url":"https://support.f5.com/csp/article/K43638305","summary":"https://support.f5.com/csp/article/K43638305"},{"url":"https://support.f5.com/csp/article/K31301245","summary":"https://support.f5.com/csp/article/K31301245"},{"url":"https://support.f5.com/csp/article/K07051153","summary":"https://support.f5.com/csp/article/K07051153"},{"url":"https://support.f5.com/csp/article/K82518062","summary":"https://support.f5.com/csp/article/K82518062"},{"url":"https://support.f5.com/csp/article/K00091341","summary":"https://support.f5.com/csp/article/K00091341"},{"url":"https://support.f5.com/csp/article/K33023560","summary":"https://support.f5.com/csp/article/K33023560"},{"url":"https://github.com/yassineaboukir/CVE-2020-5902","summary":"https://github.com/yassineaboukir/CVE-2020-5902"},{"url":"https://research.nccgroup.com/2020/07/12/understanding-the-root-cause-of-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902/","summary":"https://research.nccgroup.com/2020/07/12/understanding-the-root-cause-of-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902/"},{"url":"https://support.f5.com/csp/article/K52145254","summary":"Reference(s) from vendor \"F5 Networks Inc.\""},{"url":"https://support.f5.com/csp/article/K43638305","summary":"Reference(s) from vendor \"F5 Networks Inc.\""},{"url":"https://support.f5.com/csp/article/K31301245","summary":"Reference(s) from vendor \"F5 Networks Inc.\""},{"url":"https://support.f5.com/csp/article/K07051153","summary":"Reference(s) from vendor \"F5 Networks Inc.\""},{"url":"https://support.f5.com/csp/article/K82518062","summary":"Reference(s) from vendor \"F5 Networks Inc.\""},{"url":"https://support.f5.com/csp/article/K00091341","summary":"Reference(s) from vendor \"F5 Networks Inc.\""},{"url":"https://support.f5.com/csp/article/K33023560","summary":"Reference(s) from vendor \"F5 Networks Inc.\""}],"title":"F5 BIG-IP contains multiple vulnerabilities including unauthenticated remote command execution","tracking":{"current_release_date":"2020-07-13T14:00:54+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.35"}},"id":"VU#290915","initial_release_date":"2020-06-30 00:00:00+00:00","revision_history":[{"date":"2020-07-13T14:00:54+00:00","number":"1.20200713140054.2","summary":"Released on 2020-07-13T14:00:54+00:00"}],"status":"final","version":"1.20200713140054.2"}},"vulnerabilities":[{"title":"BIG-IP system does not properly enforce the access controls for the scp.","notes":[{"category":"summary","text":"BIG-IP system does not properly enforce the access controls for the scp.blacklist files by Admin or Resource Admin with Secure Copy (SCP) access to the device."}],"cve":"CVE-2020-5906","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#290915"}],"product_status":{"known_affected":["CSAFPID-1a740398-39ef-11f1-8422-122e2785dc9f"]}},{"title":"BIG-IP Traffic Management User Interface (TMUI)  does not sanitize all user-provided data before displaying the Network > WCCP web page.","notes":[{"category":"summary","text":"BIG-IP Traffic Management User Interface (TMUI)  does not sanitize all user-provided data before displaying the Network > WCCP web page."}],"cve":"CVE-2020-5905","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#290915"}],"product_status":{"known_affected":["CSAFPID-1a747cf6-39ef-11f1-8422-122e2785dc9f"]}},{"title":"A Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI).","notes":[{"category":"summary","text":"A Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI)."}],"cve":"CVE-2020-5903","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#290915"}],"product_status":{"known_affected":["CSAFPID-1a74f410-39ef-11f1-8422-122e2785dc9f"]}},{"title":"BIG-IP Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.","notes":[{"category":"summary","text":"BIG-IP Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages."}],"cve":"CVE-2020-5902","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#290915"}],"product_status":{"known_affected":["CSAFPID-1a7552fc-39ef-11f1-8422-122e2785dc9f"]}},{"title":"A cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists in an undisclosed page.","notes":[{"category":"summary","text":"A cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists in an undisclosed page"}],"cve":"CVE-2020-5904","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#290915"}],"product_status":{"known_affected":["CSAFPID-1a75ab9e-39ef-11f1-8422-122e2785dc9f"]}},{"title":"BIG-IP authorized users with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the built-in sftp functionality.","notes":[{"category":"summary","text":"BIG-IP authorized users with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the built-in sftp functionality"}],"cve":"CVE-2020-5907","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#290915"}],"product_status":{"known_affected":["CSAFPID-1a7625ba-39ef-11f1-8422-122e2785dc9f"]}},{"title":"F5 BIG-IP Edge Client for Linux exposes full session ID in the local log files.","notes":[{"category":"summary","text":"F5 BIG-IP Edge Client for Linux exposes full session ID in the local log files."}],"cve":"CVE-2020-5908","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#290915"}],"product_status":{"known_affected":["CSAFPID-1a768d7a-39ef-11f1-8422-122e2785dc9f"]}}],"product_tree":{"branches":[{"category":"vendor","name":"F5 Networks Inc.","product":{"name":"F5 Networks Inc. Products","product_id":"CSAFPID-1a740398-39ef-11f1-8422-122e2785dc9f"}},{"category":"vendor","name":"F5 Networks Inc.","product":{"name":"F5 Networks Inc. Products","product_id":"CSAFPID-1a747cf6-39ef-11f1-8422-122e2785dc9f"}},{"category":"vendor","name":"F5 Networks Inc.","product":{"name":"F5 Networks Inc. Products","product_id":"CSAFPID-1a74f410-39ef-11f1-8422-122e2785dc9f"}},{"category":"vendor","name":"F5 Networks Inc.","product":{"name":"F5 Networks Inc. Products","product_id":"CSAFPID-1a7552fc-39ef-11f1-8422-122e2785dc9f"}},{"category":"vendor","name":"F5 Networks Inc.","product":{"name":"F5 Networks Inc. Products","product_id":"CSAFPID-1a75ab9e-39ef-11f1-8422-122e2785dc9f"}},{"category":"vendor","name":"F5 Networks Inc.","product":{"name":"F5 Networks Inc. Products","product_id":"CSAFPID-1a7625ba-39ef-11f1-8422-122e2785dc9f"}},{"category":"vendor","name":"F5 Networks Inc.","product":{"name":"F5 Networks Inc. Products","product_id":"CSAFPID-1a768d7a-39ef-11f1-8422-122e2785dc9f"}}]}}