F5 BIG-IP Cookie Remote Information Disclosure (20089)

[Ram_T_S]

Hi Team,

In recent vulnerability scanning done on the Infra, we found the below vulnerability on server running behind the F5 VIP.

F5 BIG-IP Cookie Remote Information Disclosure (20089)

I followed the https://support.f5.com/csp/article/K14784?sr=45997495 article to encrypt the cookies

But still the vulnerability appears on the scanning

I have 2 questions:

1. How to capture the packets from my side to show the client that the encryption is happening on the F5 side
2. Is there any other solution for this Vulnerability

[PSilva]

Hi. No idea of the answer but I did find another article about this: https://devcentral.f5.com/s/articles/encrypting-cookies

Not sure if that'll help but hopefully it does. If not, pop back here and let us know.

ps

[Daniel_Wolf]

Don't get me wrong, but from experience... does the VIP have a cookie persistence profile assigned?

What kind of cookie persistence method do you use with that VIP?

Can you compare the cookies when encryption is enabled / disabled?

I would try to validate with all the above checks that the vulnerability scan is not reporting a false positive.

EDIT: Also compare when cookie encryption is enabled / disabled in the http profile.

[Daniel_Wolf · Accepted solution]

Update: today morning I googled the title and id, they appear to be from Nessus (ID 20089) and they are related to how BIG-IP systems are encoding the IP address and port number in persistence cookies.

This process is described here: K6917: Overview of BIG-IP persistence cookie encoding

and the encoding can easily be reversed. This could give a malicious actor access to sensitive information regarding your internal networks.

Follow the steps described in this KB article and you should be good.

K23254150: Configuring cookie encryption for BIG-IP persistence cookies from the cookie persistence ...

It even has a video how to do it 🙂

[Ram_T_S]

Hi,

Thanks​ for the response

Could you please tell me on which capture I can see the cookies (like tcpdump)​

[Daniel_Wolf]

Yes, with tcpdump.

There is a lab guide from some random ADC training that covers all tcpdump options and tips & tricks:

Troubleshoot with tcpdump and Wireshark

There is this awesome devcentral article on how decrypt SSL:

Decrypting TLS traffic on BIG-IP

As an alternative you can simply use Firefox or Chrome browser and start Developer Tools (F12 button). You can see the cookies from there and check whether they are encrypted or not. Just compare how they look when encryption is enabled / disabled in the profile.

[Ram_T_S]

Hi Daniel,

Thanks a lot for you answer.

I could able to resolve the issue through the Cookie encryption persistence profile, also able to demonstrate with the Developer Tools on Browser 🙂