Hello, welcome to the Monday, July 7, 2020 edition of the Sands and Internet Storm Center's

Stormcast. My name is Johannes Ulrich. And today I'm recording from Jacksonville, Florida.

Last week, an interesting F5, Big IP, warnably hit the news, and over the the weekend we have started to see active scanning

to try to find vulnerable devices. The patch was released by F5 on June 30th. It's for CVE

2020-202 and well the reason you should pay attention is that this vulnerability has a perfect 10 for its CVSS score.

Now, there are a couple of dependencies here for this vulnerability.

First of all, the traffic management user interface TMUI has to be installed

and has to be exposed. You don't have to expose it to the public. This is a management feature

and should only be available via the management plane, but then we know there are plenty of people who don't configure

these devices correctly and don't restrict access to the management interface.

And apparently, yes, there are a few thousand of them still not patched out on the Internet.

Now all of this got a little bit more prominence on July 2nd, so that was Thursday last week,

when Positive Technologies, the company that discovered this vulnerability, did release a brief blog post,

basically just announcing that they found this remote code execution

issue in F5's big IP product. As far as the impact goes, this vulnerability is pretty much as important as the

Citrix vulnerability over New Year's. However, with the Citrix vulnerability,

it was a little bit more complex to protect yourself. You couldn't just sort of isolate the management

plane in that particular case, even though that in some cases helped as well. Currently, there are plenty of tools out

there to detect if a device is vulnerable and these are the tools that are currently being used.

As one of the indicators of an exploit attempt, the URL will contain two dots followed by a semicolon.

So one of those directory traversal code injection type patterns that you would see as part of the attack.

And if you would like to scan your own network, well, there is a plugin available for NMAP.

...