K20606443 : iControl REST CSRF vulnerability CVE-2020-5922

Security Advisory Description

iControl REST does not implement cross-site request forgery (CSRF) protections for users applying basic authentication in a web browser. (CVE-2020-5922)

Impact

In a successful exploit, an attacker can run JavaScript in the context of the currently logged-in user. For an administrative user with access to the Advanced Shell (bash), successful exploitation of this vulnerability can be leveraged to compromise the BIG-IP system through remote code execution.

The attack conditions require a valid user to first authenticate to the iControl REST API using Basic Auth credentials in their browser, which is an uncommon use case and not recommended. Standard Configuration utility use of iControl REST and manually browsing REST through /mgmt/toc does not expose this issue, as these mechanisms use token-based authentication with custom HTTP headers.