CISA is warning that risk actors have been noticed abusing unencrypted persistent F5 BIG-IP cookies to establish and goal different inner gadgets on the focused community.
By mapping out inner gadgets, risk actors can probably establish weak gadgets on the community as a part of the planning phases in cyberattacks.
“CISA has noticed cyber risk actors leveraging unencrypted persistent cookies managed by the F5 BIG-IP Native Visitors Supervisor (LTM) module to enumerate different non-internet going through gadgets on the community,” warns CISA.
“A malicious cyber actor might leverage the data gathered from unencrypted persistence cookies to deduce or establish further community sources and probably exploit vulnerabilities present in different gadgets current on the community.”
F5 persistent periods cookies
F5 BIG-IP is a collection of software supply and site visitors administration instruments for load-balancing net purposes and for offering safety.
One among its core modules is the Native Visitors Supervisor (LTM) module, which offers site visitors administration and cargo balancing to distribute community site visitors throughout a number of servers. Utilizing this characteristic, prospects optimize their load-balanced server sources and excessive availability.
The Native Visitors Supervisor (LTM) module inside the product makes use of persistence cookies that assist keep session consistency by directing site visitors from purchasers (net browsers) to the identical backend server every time, which is essential for load balancing.
“Cookie persistence enforces persistence utilizing HTTP cookies,” explains F5’s documentation.
“As with all persistence modes, HTTP cookies guarantee that requests from the identical shopper are directed to the identical pool member after the BIG-IP system initially load-balances them. If the identical pool member will not be obtainable, the system makes a brand new load balancing choice.”
These cookies are unencrypted by default, prone to keep operational integrity with legacy configurations or as a result of efficiency issues.
Beginning in model 11.5.0 and onward, directors got a brand new “Required” choice to implement encryption on all cookies. Those that opted to not allow it have been uncovered to safety dangers.
Nonetheless, these cookies comprise encoded IP addresses, port numbers, and load-balancing setups of the interior load-balanced servers.
For years, cybersecurity researchers have shared how the unencrypted cookies might be abused to seek out beforehand hidden inner servers or attainable unknown uncovered servers that may be scanned for vulnerabilities and used to breach an inner community. A Chrome extension was additionally launched for decoding these cookies to assist BIG-IP directors troubleshoot connections.
In response to CISA, risk actors are already tapping into this potential, exploiting lax configurations for community discovery.
CISA recommends that F5 BIG-IP directors evaluate the vendor’s directions (additionally right here) on how one can encrypt these persistent cookies.
Notice {that a} midpoint “Most well-liked” configuration choice generates encrypted cookies but additionally permits the system to simply accept unencrypted cookies. This setting can be utilized throughout the migration part to permit beforehand issued cookies to proceed to work earlier than imposing encrypted cookies.
When set to “Required,” all persistent cookies are ciphered utilizing robust AES-192 encryption.
CISA additionally notes that F5 has developed a diagnostic instrument named ‘BIG-IP iHealth‘ designed to detect misconfigurations on the product and warn admins about them.