Description
F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- F5 BIG-IQ 4.1.0.2013.0 - Privilege Escalation (Metasploit) EDB-33143 · remote · May 2, 2014
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://volatile-minds.blogspot.com/2014/05/f5-big-iq-v41020130-authenticated.html
- 33143 exploit
- https://gist.github.com/brandonprry/2e73acd63094fa2a4f63
- 67191 vdb-entry
- http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15229.html
- 67227 vdb-entry
- 58440 third-party-advisory
- 20140501 F5 BIG-IQ authed arbitrary user password change mailing-list
- 20140504 Re: F5 BIG-IQ authed arbitrary user password change mailing-list
- 20140502 Re: F5 BIG-IQ authed arbitrary user password change mailing-list