Forum Discussion
Ram_T_S
Altostratus
AltostratusF5 BIG-IP Cookie Remote Information Disclosure (20089)
Hi Team, In recent vulnerability scanning done on the Infra, we found the below vulnerability on server running behind the F5 VIP. F5 BIG-IP Cookie Remote Information Disclosure (20089) I fol...
Update: today morning I googled the title and id, they appear to be from Nessus (ID 20089) and they are related to how BIG-IP systems are encoding the IP address and port number in persistence cookies.
This process is described here: K6917: Overview of BIG-IP persistence cookie encoding
and the encoding can easily be reversed. This could give a malicious actor access to sensitive information regarding your internal networks.
Follow the steps described in this KB article and you should be good.
It even has a video how to do it :)
Ram_T_SAltostratus
AltostratusHi,
Thanks for the response
Could you please tell me on which capture I can see the cookies (like tcpdump)
Daniel_Wolf
MVP
MVPYes, with tcpdump.
There is a lab guide from some random ADC training that covers all tcpdump options and tips & tricks:
Troubleshoot with tcpdump and Wireshark
There is this awesome devcentral article on how decrypt SSL:
Decrypting TLS traffic on BIG-IP
As an alternative you can simply use Firefox or Chrome browser and start Developer Tools (F12 button). You can see the cookies from there and check whether they are encrypted or not. Just compare how they look when encryption is enabled / disabled in the profile.