For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Cyril_M's avatar
Cyril_M
Icon for Altostratus rankAltostratus
Dec 30, 2019

DELETE method with AS3 is too powerful !

Am I the only one totally freaking out about the fact that with AS3, you just have to send a DELETE method to mgmt/shared/appsvcs/declare and everything is gone ?? All your production system could be...
application delivery
AS3
BIG-IP
devops
iControlLX
Cyril_M's avatar
Cyril_M
Icon for Altostratus rankAltostratus
Dec 31, 2019

Well first of all I'm not using BigIQ :) But I get the point

 

Don't get me wrong I'm not saying that it is too much power to be allowed to delete everything ; I'm saying that it's too easy to make a mistake, and it could totally happen by accident ... If you just miss the argument, because you used a variable that has not been populated for instance ... I totally see that coming from miles away :)

 

tenant=$1

DELETE https://192.0.2.10/mgmt/shared/appsvcs/declare/$tenant

 

How are you sure that it will not delete everything while you just wanted to delete the TEST tenant ? :)

I'm really afraid of a collateral damage, due to a totally honest mistake in code management or postman misuse ...

And that's why I'm saying that I would feel a little bit more confident if a parameter was mandatory associated with the DELETE command

 

You could argue that it like the "rm /." when you wanted to "rm ./" but at least there is the -f to save your sorry ass :)

 

 

  • Chase_Abbott's avatar
    Chase_Abbott
    Icon for Admin rankAdmin
    Dec 31, 2019

    Really the better answer would be RBAC within BIG-IP native to allow a basic subset of roles that BIG-IQ uses. But that's my opinion only. 😐

     

    Update: I think we'll follow up internally on this to see if there's an interesting discussion around your question and idea.