NimbostratusF5 BIG-IP Cookie Information Disclosure Vulnerability
I ran into an issue, it says "F5 BIG-IP Cookie Information Disclosure Vulnerability". I tried out both solutions as follows, the problem still didn't get resolved. Did I do something wrong? Is there someone able to help me on this? Thank you. (My f5 version is 9.44)
-
Configuring cookie encryption by using the BIG-IP Configuration utility a..Log in to the Configuration utility. b.Click Local Traffic. c.Click Profiles. d.From the Services drop-down menu, select HTTP. e.Click Create. f.Enter a name for the HTTP profile. g.In the Encrypt Cookies box, enter one or more cookie names. h.In the Cookie Encryption Passphrase box, enter a passphrase for the cookie. i.To confirm the passphrase for the cookie, in the Confirm Cookie Encryption Passphrase box, re-type the passphrase. j.Click Update. k.Associate the HTTP profile with the virtual server.
-
HTTP::cookie encrypt / decrypt I added a new iRule as following. 01 when CLIENT_ACCEPTED {
02 set cookiename "MyCookie" 03 set encryption_passphrase "abcd1234" 04 }
05 when HTTP_RESPONSE {
06 if { [HTTP::cookie exists $cookiename] } {
07 HTTP::cookie encrypt $cookiename $encryption_passphrase 08 }
09 }
10 when HTTP_REQUEST {
11 if { [HTTP::cookie exists $cookiename] } {
12 set decrypted [HTTP::cookie decrypt $cookiename $encryption_passphrase]
13 if { ($decrypted eq "") } {
14 Cookie wasn't encrypted, delete it
15 HTTP::cookie remove $cookiename 16 }
17 }
18 }
