CISA is warning that menace actors have been noticed abusing unencrypted persistent F5 BIG-IP cookies to establish and goal different inside gadgets on the focused community.
By mapping out inside gadgets, menace actors can probably establish susceptible gadgets on the community as a part of the planning levels in cyberattacks.
“CISA has noticed cyber menace actors leveraging unencrypted persistent cookies managed by the F5 BIG-IP Native Visitors Supervisor (LTM) module to enumerate different non-internet going through gadgets on the community,” warns CISA.
“A malicious cyber actor might leverage the data gathered from unencrypted persistence cookies to deduce or establish extra community sources and probably exploit vulnerabilities present in different gadgets current on the community.”
F5 persistent classes cookies
F5 BIG-IP is a set of utility supply and site visitors administration instruments for load-balancing net functions and for offering safety.
One in all its core modules is the Native Visitors Supervisor (LTM) module, which gives site visitors administration and cargo balancing to distribute community site visitors throughout a number of servers. Utilizing this function, clients optimize their load-balanced server sources and excessive availability.
The Native Visitors Supervisor (LTM) module inside the product makes use of persistence cookies that assist preserve session consistency by directing site visitors from purchasers (net browsers) to the identical backend server every time, which is essential for load balancing.
“Cookie persistence enforces persistence utilizing HTTP cookies,” explains F5’s documentation.
“As with all persistence modes, HTTP cookies guarantee that requests from the identical shopper are directed to the identical pool member after the BIG-IP system initially load-balances them. If the identical pool member isn’t obtainable, the system makes a brand new load balancing choice.”
These cookies are unencrypted by default, prone to preserve operational integrity with legacy configurations or as a consequence of efficiency concerns.
Beginning in model 11.5.0 and onward, directors got a brand new “Required” choice to implement encryption on all cookies. Those that opted to not allow it have been uncovered to safety dangers.
Nonetheless, these cookies include encoded IP addresses, port numbers, and load-balancing setups of the inner load-balanced servers.
For years, cybersecurity researchers have shared how the unencrypted cookies might be abused to search out beforehand hidden inside servers or attainable unknown uncovered servers that may be scanned for vulnerabilities and used to breach an inside community. A Chrome extension was additionally launched for decoding these cookies to help BIG-IP directors troubleshoot connections.
In response to CISA, menace actors are already tapping into this potential, exploiting lax configurations for community discovery.
CISA recommends that F5 BIG-IP directors evaluate the vendor’s directions (additionally right here) on methods to encrypt these persistent cookies.
Be aware {that a} midpoint “Most popular” configuration choice generates encrypted cookies but additionally permits the system to just accept unencrypted cookies. This setting can be utilized throughout the migration section to permit beforehand issued cookies to proceed to work earlier than imposing encrypted cookies.
When set to “Required,” all persistent cookies are ciphered utilizing sturdy AES-192 encryption.
CISA additionally notes that F5 has developed a diagnostic device named ‘BIG-IP iHealth‘ designed to detect misconfigurations on the product and warn admins about them.