Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.0627.2
K40507733: The BIG-IP APM logon page may expose an XSS security risk
14 March 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: F5 BIG-IP APM
Publisher: F5 Networks
Operating System: Network Appliance
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Mitigation
Original Bulletin:
https://support.f5.com/csp/article/K40507733
Revision History: March 14 2018: Updated source text with improved workaround.
March 5 2018: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
K40507733: The BIG-IP APM logon page may expose an XSS security risk
Security Advisory
Original Publication Date: Mar 03, 2018
Updated Date: Mar 14, 2018
Security Advisory Description
This issue occurs when all of the following conditions are met:
* You configure an authentication, authorization, and accounting (AAA) agent
after a logon page agent in the access policy.
* You configure the AAA agent with a Max Logon Attempts Allowed value higher
than 1.
* You configure the BIG-IP APM system with either of the following profiles:
+ A Secure Web Gateway (SWG) transparent profile running 11.6.x or
12.1.1.
+ Any BIG-IP APM profile running 12.1.2 and later.
Impact
A malicious actor may be able to use web phishing techniques and launch a
cross-site scripting (XSS) attack on the BIG-IP APM logon page, presenting the
end user with a crafted BIG-IP APM logon page and enforcing the end users to
click on href links on the crafted logon page.
Symptoms
As a result of this issue, you may encounter the following symptom:
* End users are presented with a crafted logon page containing malicious
code.
Security Advisory Status
F5 Product Development has assigned ID 702278 to this issue. F5 has confirmed
that this issue exists in the products listed in the Applies to (see versions)
box, located in the upper-right corner of this article. For information about
releases, point releases, or hotfixes that resolve this issue, refer to the
following table.
+---------------------------------------------------------+
|Type of fix |Fixes introduced in|Related articles|
|--------------------+-------------------+----------------|
|Release |None |None |
|--------------------+-------------------+----------------|
|Point release/hotfix|None |None |
+---------------------------------------------------------+
Security Advisory Recommended Actions
Workaround
* 12.1.2 and later with any BIG-IP APM profile configured
* 11.6.x and 12.1.1 with the SWG transparent profile configured
12.1.2 and later with any BIG-IP APM profile configured
To work around this issue, you can modify the logon.inc code of the affected
access profile, removing the setOrigUriLink() call in function OnLoad(). To do
so, perform the following procedure:
Impact of workaround: Performing the suggested workaround should not have a
negative impact on your system performance. However, when using an
SWG-transparent profile and accessing another website URL on a separate browser
tab, users must manually reauthenticate or refresh the browser tab as the URL
link embedded by the setOrigUriLink()function will not display.
1. Log in to the Configuration utility.
2. Navigate to Access Policy > Customization > Advanced.
3. Expand the Access Profiles section.
4. Select the affected access profile.
5. Expand the affected access profile Logon Pages section.
6. Expand the Logon Page section.
7. Click logon.inc.
8. Remove/comment the setOrigUriLink() call line in the function OnLoad()
(approximately lines 378):
function OnLoad()
{
var header = document.getElementById("credentials_table_header");
var softTokenHeaderStr = getSoftTokenPrompt();
if ( softTokenHeaderStr ) {
header.innerHTML = softTokenHeaderStr;
}
setFormAttributeByQueryParams("auth_form", "action", "/
subsession_logon_submit.php3");
setFormAttributeByQueryParams("v2_original_url", "href", "/
subsession_logon_submit.php3");
// ===> REMOVE THIS CALL setOrigUriLink();
9. In the upper-right corner of the code editor, click Save Draft.
10. In the Do you want to save your changes? window, click Yes.
11. In the upper-left corner of the editor, click Save.
12. In the upper-left corner of the Configuration utility, click Apply Access
Policy.
13. Click Apply Access Policy.
11.6.x and 12.1.1 with the SWG transparent profile configured
To work around this issue, you can modify the logon.inc code and change the
href that print the text "Click here if already logged in" of the affected
access profile. To do so, perform the following procedure:
Impact of workaround: Performing the suggested workaround should not have a
negative impact on your system.
1. Log in to the Configuration utility.
2. Navigate to Access Policy > Customization > Advanced.
3. Expand the Access Profiles section.
4. Select the affected access profile.
5. Expand the affected access profile Logon Pages section.
6. Expand the Logon Page section.
7. Click logon.inc.
8. Remove/comment the following two lines:
<? print( 'Click here if already logged in ' );?>
<a href="<? print($origUrlDecoded ); ?>"><? print( $origUrlDecoded ); ?></a>
9. Replace the above lines with the following line:
<a href="javascript:window.history.back()"><? print( 'Click here if already logged in' ); ?></a>
10. In the upper-right corner of the code editor, click Save Draft.
11. In the Do you want to save your changes? window, click Yes.
12. In the upper-left corner of the editor, click Save.
13. In the upper-left corner of the Configuration utility, click Apply Access
Policy.
14. Click Apply Access Policy.
Acknowledgements
F5 would like to acknowledge Timothy Gan Z. for bringing this issue to our
attention.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWqh+6Ix+lLeg9Ub1AQhkjA/9FEt7tH0+y2xs7T26EIUMtMmIlJXQE0vU
tWePC/0XRqw76gjuQRs8ppHOrYZLycj+w/mnDo6F8bTg2W7MvU7rqRSeNQNhGPSN
ZeGClGLnsNBtUvmqb5jkTl60h8GcOdhZIyuHu4r5xJd6nw0sJTig/+Yr2LaY56qe
Jk+kPBzXgmktEkVDo4G+bzzakWa5gOinX/09B4M60a8uvxEYcdxXBww7aoarfgyV
j6Fc676OP43aMf+C+ZYY/STHbn/yu++M/yza3qKxarrJfnl7DzlZuGM1a1rLiw0p
CoqL8Xve1kGWziKQCLlvwUCUMMyIVonfz2pmo7t8WkJ/ZvwXVoel235xXbnJ6iJp
0vNkl6jCMxbaxeS4+4M/NHtDTktY0HR8Cm4Ldq2YiJhDnnvQ64j+GspeoLxI0pWA
qLmGhHwUBrotK7o4XP6UPCSCwLfGeVgW48jb4hDCcty8442ZIxGNCEF3SmZtst/S
uoxmB2Newfq/EvY+zTtMzyWlzJgHzKfph/gdZCosDZ/LbWkMgWxlm4tJQVj+HcHu
Nd294pEbKWlmcOVq7BIShRGXd33wmKDcC90rpxeW+VXjNfQ2u15LTjv9loJLBv5b
9Gp/Jweuu9Ar750+Y5x/PO64UasE3my9JhZXL1xdSpFTTGeOqfbK6w3F13wCQ/2p
Viu1w/pGGE4=
=fN+1
-----END PGP SIGNATURE-----