Information disclosure in F5 BIG-IP iControl REST

1) Information disclosure

EUVDB-ID: #VU13530

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-12536

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to improper handling of queries that do not match the dynamic URL pattern for webapps that use default error handling settings. A remote attacker can send a query that submits malicious input, trigger a java.nio.file.InvalidPathException message, which could allow the attacker to view sensitive information, such as the software installation path.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

BIG-IP: 14.1.0 - 16.1.2.1

CPE2.3

• cpe:2.3:h:f5_networks:big-ip:14.1.4.5:*:*:*:*:*:*:*
• cpe:2.3:h:f5_networks:big-ip:15.1.5:*:*:*:*:*:*:*
• cpe:2.3:h:f5_networks:big-ip:16.1.2.1:*:*:*:*:*:*:*

External links

https://support.f5.com/csp/article/K33548065

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.