F5 ICall::Script Privilege Escalation (CVE-2015-3628)

Tuesday, September 8, 2015 At 6:14AM

Overview

Earlier this year GDS discovered a vulnerability in the F5 BIG-IP LTM product that allows a user with limited access to the system to escalate privileges and obtain highly privileged remote command execution on the device.

This issue was identified in the SOAP interface exposed on these devices at https://<host>/iControl/iControlPortal.cgi (a similar issue, although in a completely different function, was previously found in this same interface – see CVE-2014-2928). An attacker with valid credentials for the web interface and the Resource Administrator role can abuse the iCall SOAP functions to run arbitrary commands on the device with root privileges.

Am I vulnerable?

This vulnerability has been fixed in BIG-IP version 12.0 and 11.5.3 HF2. Other versions of BIG-IP from 11.3 to 11.6 have been confirmed to be vulnerable. Additionally, all versions of BIG-IQ and versions of Enterprise Manager from 3.1 are vulnerable. For more detailed information see the F5 Security Advisory.

Exploitation

Detailed exploitation information is available on request and will be published after further patches are released.

Remediation

Upgrade to BIG-IP version 12.0 or apply vendor patches once they are released. In the interim review configuration for any accounts in the Resource Administrator role. Update the configuration to use the least privilege necessary, while acknowledging that Resource Administrators have unconstrained privileges until this issue is patched.

Gotham Digital Science, LLC (GDS), is a wholly owned subsidiary of Aon, PLC

This material has been prepared for informational purposes only and should not be relied on for any other purpose. You should consult with your own professional advisors or IT specialists before implementing any recommendation or following the guidance provided herein. Further, the information provided and the statements expressed are not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information and use sources that we consider reliable, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. The examples provided in this article are not based upon an actual Stroz/Aon client, but was provided for illustrative purposes only.

About Cyber Solutions
Cyber security services are offered by Stroz Friedberg Inc., its subsidiaries and affiliates. Stroz Friedberg is part of Aon’s Cyber Solutions which offers holistic cyber risk management, unsurpassed investigative skills, and proprietary technologies to help clients uncover and quantify cyber risks, protect critical assets, and recover from cyber incidents.