Forum Discussion

Ram_T_S's avatar
Ram_T_S
Icon for Altostratus rankAltostratus
Mar 11, 2021
Solved

F5 BIG-IP Cookie Remote Information Disclosure (20089)

Hi Team,

 

In recent vulnerability scanning done on the Infra, we found the below vulnerability on server running behind the F5 VIP.

F5 BIG-IP Cookie Remote Information Disclosure (20089)

I followed the https://support.f5.com/csp/article/K14784?sr=45997495 article to encrypt the cookies

But still the vulnerability appears on the scanning

I have 2 questions:

  1. How to capture the packets from my side to show the client that the encryption is happening on the F5 side
  2. Is there any other solution for this Vulnerability
LTM
security

6 Replies

Sort By
  • Daniel_Wolf's avatar
    Daniel_Wolf
    Icon for MVP rankMVP
    Mar 13, 2021

    Update: today morning I googled the title and id, they appear to be from Nessus (ID 20089) and they are related to how BIG-IP systems are encoding the IP address and port number in persistence cookies.

     

    This process is described here: K6917: Overview of BIG-IP persistence cookie encoding

    and the encoding can easily be reversed. This could give a malicious actor access to sensitive information regarding your internal networks.

     

    Follow the steps described in this KB article and you should be good.

    K23254150: Configuring cookie encryption for BIG-IP persistence cookies from the cookie persistence profile

    It even has a video how to do it :)

  • PSilva's avatar
    PSilva
    Ret. Employee
    Mar 12, 2021

    Hi. No idea of the answer but I did find another article about this: https://devcentral.f5.com/s/articles/encrypting-cookies

     

    Not sure if that'll help but hopefully it does. If not, pop back here and let us know.

     

    ps

     

  • Daniel_Wolf's avatar
    Daniel_Wolf
    Icon for MVP rankMVP
    Mar 12, 2021

    Don't get me wrong, but from experience... does the VIP have a cookie persistence profile assigned?

    What kind of cookie persistence method do you use with that VIP?

    Can you compare the cookies when encryption is enabled / disabled?

     

    I would try to validate with all the above checks that the vulnerability scan is not reporting a false positive.

     

    EDIT: Also compare when cookie encryption is enabled / disabled in the http profile.

  • Ram_T_S's avatar
    Ram_T_S
    Icon for Altostratus rankAltostratus
    Mar 15, 2021

    Hi,

    ​

    Thanks​ for the response

    Could you please tell me on which capture I can see the cookies (like tcpdump)​

    • Daniel_Wolf's avatar
      Daniel_Wolf
      Icon for MVP rankMVP
      Mar 15, 2021

      Yes, with tcpdump.

       

      There is a lab guide from some random ADC training that covers all tcpdump options and tips & tricks:

      Troubleshoot with tcpdump and Wireshark

       

      There is this awesome devcentral article on how decrypt SSL:

      Decrypting TLS traffic on BIG-IP

       

      As an alternative you can simply use Firefox or Chrome browser and start Developer Tools (F12 button). You can see the cookies from there and check whether they are encrypted or not. Just compare how they look when encryption is enabled / disabled in the profile.

  • Ram_T_S's avatar
    Ram_T_S
    Icon for Altostratus rankAltostratus
    Mar 16, 2021

    Hi Daniel,

     

    Thanks a lot for you answer.

    I could able to resolve the issue through the Cookie encryption persistence profile, also able to demonstrate with the Developer Tools on Browser :)