Critical F5 BIG-IP vulnerability made public

Users of F5 enterprise and data centre BIG-IP network products are warned to patch the devices as soon as possible to handle a critical, easy to exploit remote code execution vulnerability that has now been made public.

Examples of the exploit have now been posted on social media, one of which uses a single line of code that calls a JavaServer Page function to reveal the passwords stored on BIG-IP devices.

The vulnerability rates as 10 out 10 on the Common Vulnerabilities Scoring System, and lies in lack of proper access control for the Traffic Management User Interface (TMUI) configuration utility for the devices.

"This vulnerability allows for unauthenticated attackers, or authenticated users, with network access to the TMUI, through the BIG-IP management port and/or Self IPs, to execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code. [It] may result in complete system compromise," F5 wrote in its advisory.

The United States Cyber Security and Infrastructure Agency is asking F5 users to patch their devices as soon as possible.

URGENT: Patching CVE-2020-5902 and 5903 should not be postponed over the weekend. Remediate immediately. https://t.co/UBKECuN7Vv

— USCYBERCOM Cybersecurity Alert (@CNMF_CyberAlert) July 3, 2020

Multiple versions of BIG-IP are vulnerable.

While it is possible to apply mitigations against the vulnerability, they are only partially effective and patching as soon as possible is advised by F5.

Security researchers warned that the vulnerability could become massively exploited and compared it to the critical Citrix Netscaler flaw from earlier this year that hackers were quick to take advantage of.