PT-2014-8692 · F5 · Big-Ip

Published 2014-11-17 · Updated 2017-09-08 · CVE-2014-8727

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 10.2.2

Description The issue allows local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files. This is achieved by exploiting directory traversal vulnerabilities using a .. (dot dot) in the name parameter to specific API endpoints, such as "tmui/Control/jspmap/tmui/system/archive/properties.jsp" or "tmui/Control/form".

Recommendations For versions prior to 10.2.2, update to version 10.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the name parameter in the affected API endpoints until a patch is available. Restrict access to the vulnerable API endpoints "tmui/Control/jspmap/tmui/system/archive/properties.jsp" and "tmui/Control/form" to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-8727

Affected Products

Big-Ip

References · 9

• 🔥 https://exploit-db.com/exploits/35222 · Exploit
• 🔥 http://packetstormsecurity.com/files/129084/F5-BIG-IP-10.1.0-Directory-Traversal.html · Exploit
• 🔥 http://exploit-db.com/exploits/35222 · Exploit
• https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13109.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8727 · Security Note
• http://securitytracker.com/id/1031216 · Note
• http://securityfocus.com/bid/71063 · Note
• https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote_11_0_0_ltm.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98676 · Note