Multiple vulnerabilities in NGINX Controller



Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2020-5867
CVE-2020-5866
CVE-2020-5865
CWE-ID CWE-300
CWE-200
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		NGINX Controller
Server applications / Web servers

Vendor F5 Networks

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU27303

Risk: Medium

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-5867

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a man-in-the-middle (MitM) attack.

The vulnerability exists due to the NGINX Controller Agent installer script "install.sh" uses HTTP instead of HTTPS to check and install packages. A remote attacker can perform a MitM attack, intercept the insecure HTTP channel, convincingly forge any packages and get the malicious packages installed on the NGINX Plus instance.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

NGINX Controller: 1.0.1 - 3.2.0

CPE2.3 External links

http://support.f5.com/csp/article/K00958787


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU27302

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-5866

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to the helper.sh script uses sensitive items as command-line arguments. A local user can gain unauthorized access to those sensitive items.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

NGINX Controller: 1.0.1 - 3.2.0

CPE2.3 External links

http://support.f5.com/csp/article/K11922628


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU27301

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-5865

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a man-in-the-middle (MitM) attack.

The vulnerability exists due to the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels. A remote attacker can perform a MitM attack, intercept communicated data and modify user entered data or run arbitrary SQL commands against the database server.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

NGINX Controller: 1.0.1 - 3.2.0

CPE2.3 External links

http://support.f5.com/csp/article/K21009022


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###