Forum Discussion
Ram_T_S
Altostratus
AltostratusF5 BIG-IP Cookie Remote Information Disclosure (20089)
Hi Team,
In recent vulnerability scanning done on the Infra, we found the below vulnerability on server running behind the F5 VIP.
F5 BIG-IP Cookie Remote Information Disclosure (20089)
I followed the https://support.f5.com/csp/article/K14784?sr=45997495 article to encrypt the cookies
But still the vulnerability appears on the scanning
I have 2 questions:
- How to capture the packets from my side to show the client that the encryption is happening on the F5 side
- Is there any other solution for this Vulnerability
Update: today morning I googled the title and id, they appear to be from Nessus (ID 20089) and they are related to how BIG-IP systems are encoding the IP address and port number in persistence cookies.
This process is described here: K6917: Overview of BIG-IP persistence cookie encoding
and the encoding can easily be reversed. This could give a malicious actor access to sensitive information regarding your internal networks.
Follow the steps described in this KB article and you should be good.
It even has a video how to do it :)
- Daniel_Wolf
MVP
Update: today morning I googled the title and id, they appear to be from Nessus (ID 20089) and they are related to how BIG-IP systems are encoding the IP address and port number in persistence cookies.
This process is described here: K6917: Overview of BIG-IP persistence cookie encoding
and the encoding can easily be reversed. This could give a malicious actor access to sensitive information regarding your internal networks.
Follow the steps described in this KB article and you should be good.
It even has a video how to do it :)
Hi. No idea of the answer but I did find another article about this: https://devcentral.f5.com/s/articles/encrypting-cookies
Not sure if that'll help but hopefully it does. If not, pop back here and let us know.
ps
- Daniel_Wolf
Don't get me wrong, but from experience... does the VIP have a cookie persistence profile assigned?
What kind of cookie persistence method do you use with that VIP?
Can you compare the cookies when encryption is enabled / disabled?
I would try to validate with all the above checks that the vulnerability scan is not reporting a false positive.
EDIT: Also compare when cookie encryption is enabled / disabled in the http profile.
Ram_T_SHi,
Thanks for the response
Could you please tell me on which capture I can see the cookies (like tcpdump)
- Daniel_Wolf
Yes, with tcpdump.
There is a lab guide from some random ADC training that covers all tcpdump options and tips & tricks:
Troubleshoot with tcpdump and Wireshark
There is this awesome devcentral article on how decrypt SSL:
Decrypting TLS traffic on BIG-IP
As an alternative you can simply use Firefox or Chrome browser and start Developer Tools (F12 button). You can see the cookies from there and check whether they are encrypted or not. Just compare how they look when encryption is enabled / disabled in the profile.
- Ram_T_S
Hi Daniel,
Thanks a lot for you answer.
I could able to resolve the issue through the Cookie encryption persistence profile, also able to demonstrate with the Developer Tools on Browser :)
