F5 BIG-IP Web Management Console CSRF

[nnposter () disclosed not]

F5 BIG-IP Web Management Console CSRF


Product: F5 BIG-IP
http://www.f5.com/products/big-ip/


By design the F5 BIG-IP web management interface allows a logged-in user with Resource Manager or Administrator 
privileges to execute an arbitrary bigpipe shell command through the web "Console" feature. It is possible to craft URL 
links that would execute the command with a simple HTTP GET request. Cross-site  attacks may leverage this 
functionality to reconfigure the BIG-IP appliance, including creating new administrators.


The vulnerability has been identified in version 9.4.3. However, other versions may be also affected.


Solution:
Administrators should not browse untrusted sites while logged into the BIG-IP web management interface. It is not 
possible to log out of the interface so it is important to shut down the browser after the interface is no longer 
needed. Closing the interface browser window or removing the BIG-IP cookie is not sufficient.


Found by:
nnposter