cancel
Showing results for 
Search instead for 
Did you mean: 

F5 BIG-IP Cookie Remote Information Disclosure (20089)

Ram_T_S
Altostratus
Altostratus

Hi Team,

 

In recent vulnerability scanning done on the Infra, we found the below vulnerability on server running behind the F5 VIP.

F5 BIG-IP Cookie Remote Information Disclosure (20089)

I followed the https://support.f5.com/csp/article/K14784?sr=45997495 article to encrypt the cookies

But still the vulnerability appears on the scanning

I have 2 questions:

  1. How to capture the packets from my side to show the client that the encryption is happening on the F5 side
  2. Is there any other solution for this Vulnerability
1 ACCEPTED SOLUTION

Update: today morning I googled the title and id, they appear to be from Nessus (ID 20089) and they are related to how BIG-IP systems are encoding the IP address and port number in persistence cookies.

 

This process is described here: K6917: Overview of BIG-IP persistence cookie encoding

and the encoding can easily be reversed. This could give a malicious actor access to sensitive information regarding your internal networks.

 

Follow the steps described in this KB article and you should be good.

K23254150: Configuring cookie encryption for BIG-IP persistence cookies from the cookie persistence ...

It even has a video how to do it 🙂

View solution in original post

6 REPLIES 6

PSilva
Community Manager
Community Manager

Hi. No idea of the answer but I did find another article about this: https://devcentral.f5.com/s/articles/encrypting-cookies

 

Not sure if that'll help but hopefully it does. If not, pop back here and let us know.

 

ps

 

ps

Don't get me wrong, but from experience... does the VIP have a cookie persistence profile assigned?

What kind of cookie persistence method do you use with that VIP?

Can you compare the cookies when encryption is enabled / disabled?

 

I would try to validate with all the above checks that the vulnerability scan is not reporting a false positive.

 

EDIT: Also compare when cookie encryption is enabled / disabled in the http profile.

Update: today morning I googled the title and id, they appear to be from Nessus (ID 20089) and they are related to how BIG-IP systems are encoding the IP address and port number in persistence cookies.

 

This process is described here: K6917: Overview of BIG-IP persistence cookie encoding

and the encoding can easily be reversed. This could give a malicious actor access to sensitive information regarding your internal networks.

 

Follow the steps described in this KB article and you should be good.

K23254150: Configuring cookie encryption for BIG-IP persistence cookies from the cookie persistence ...

It even has a video how to do it 🙂

Ram_T_S
Altostratus
Altostratus

Hi,

Thanks​ for the response

Could you please tell me on which capture I can see the cookies (like tcpdump)​

Yes, with tcpdump.

 

There is a lab guide from some random ADC training that covers all tcpdump options and tips & tricks:

Troubleshoot with tcpdump and Wireshark

 

There is this awesome devcentral article on how decrypt SSL:

Decrypting TLS traffic on BIG-IP

 

As an alternative you can simply use Firefox or Chrome browser and start Developer Tools (F12 button). You can see the cookies from there and check whether they are encrypted or not. Just compare how they look when encryption is enabled / disabled in the profile.

Ram_T_S
Altostratus
Altostratus

Hi Daniel,

 

Thanks a lot for you answer.

I could able to resolve the issue through the Cookie encryption persistence profile, also able to demonstrate with the Developer Tools on Browser 🙂