Hello, welcome to the Monday, May 9th, 2020 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

On Thursday, F5 announced a patch for a big IP for its load balancer appliances, affecting the iControl Rest API.

Exploitation does not require any authentication

and leads to remote code execution,

making this a big deal.

Also, all versions, but the very latest ones,

are vulnerable.

And to top it off, well, exploits are already

being advertised as being created and at least one researcher noted that they will make

their exploit public later this week. But well, there's one way to mitigate this vulnerability and imagine

that it's protecting access to the management interface or the self-IP address. The other mitigation

is to change the configuration of the device and essentially force all connections to be closed instead of using Keep Alive.

Apparently, the root cause here is some kind of request smuggling where you are adding a second

request as sort of the body of a first request and confuse the device as to what request it's processing. Now, since not

exposing the self-IP and the management interface is sort of standard procedure for these devices.

Highly recommended and also all the setup features and such are guiding you towards that way. I don't think this will

be such a big deal. There are some devices exposed according to some scanners like census

lists about 2000. Of course, not known how many of them are vulnerable or how many of them are honeypots or something

else that just looks like a big IP device. If you are using Big IP, definitely patch and

absolutely make sure that you control access to the management interface. And talking about things that you should not expose to the management interface.

And talking about things that you should not expose to the internet, QNAP has an update for its video recorder software. So if you're using your QNAP device as a network video recorder,

then please apply the update and make sure it's not exposed to

...