CERT-In Vulnerability Note
CIVN-2024-0160
Multiple vulnerabilities in F5 products
Original Issue Date:May 13, 2024
Severity Rating: HIGH
Software Affected
- BIG-IP Next Central Manager
- 20.0.1 - 20.0.2
- 20.0.1 - 20.1.0
- BIG-IP (all modules)
- 15.1.0 - 15.1.10
- 16.1.0 - 16.1.4
- 17.1.0 - 17.1.1
Overview
Multiple Vulnerabilities have been reported in F5 BIG-IP Next Central Manager and node.js software which could allow a remote attacker to perform man-in-the-middle, SQL injection and denial of service attack on the affected system.
Description
1. Man-in-middle Attack Vulnerability
(
CVE-2024-32049
)
This Vulnerability exists in F5 BIG-IP Next Central Manager due to flaw in the SSL communication between BIG-IP Next LTM/WAF instance and BIG-IP Next Central Manager. An attacker could exploit this vulnerability by modifying and decrypt the SSL communication between BIG-IP Next LTM/WAF instance and BIG-IP Next Central Manager.
Successful exploitation of this vulnerability could allow the attacker to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain BIG-IP Next LTM/WAF instance credentials.
2. SQL Injection Vulnerability
(
CVE-2024-21793
CVE-2024-26026
)
These Vulnerabilities exist in F5 BIG-IP Next Central Manager due to the system is configured with Lightweight Directory Access protocol (LDAP) for user authentication. An attacker could exploit these vulnerabilities by sending specially crafted SQL statements to the API endpoint.
Successful exploitation of these vulnerabilities could allow the attacker to view, add, modify or delete information in the back-end database.
3. Denial of Service Vulnerability
(
CVE-2024-27983
)
This Vulnerability exists in Node.js component integrated in BIG-IP product due to an assertion failure in node::http2::Http2Session::~Http2Session(). An attacker could exploit this vulnerability by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside.
Successful exploitation of this vulnerability could allow the attacker to cause a denial-of-service (DoS) attack on the affected system and make the Node.js HTTP/2 server completely unavailable.
Solution
Apply appropriate updates as mentioned in:
https://my.f5.com/manage/s/article/K000138634
https://my.f5.com/manage/s/article/K000138732
https://my.f5.com/manage/s/article/K000138733
https://my.f5.com/manage/s/article/K000139532
Vendor Information
F5
https://my.f5.com/manage/s/article/K000138634
https://my.f5.com/manage/s/article/K000138732
https://my.f5.com/manage/s/article/K000138733
https://my.f5.com/manage/s/article/K000139532
References
F5
https://my.f5.com/manage/s/article/K000138634
https://my.f5.com/manage/s/article/K000138732
https://my.f5.com/manage/s/article/K000138733
https://my.f5.com/manage/s/article/K000139532
CVE Name
CVE-2024-32049
CVE-2024-21793
CVE-2024-26026
CVE-2024-27983
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|