K75532331 : iRulesLX debug NodeJS vulnerability CVE-2019-6644

Security Advisory Description

Similar to the issue identified in CVE-2018-12120, the BIG-IP system will bind a debug nodejs process to all interfaces when invoked. This may expose the process to unauthorized users if the plugin is left in debug mode and the port is accessible. (CVE-2019-6644)

Impact

A remote attacker may be able to attach a remote computer to the debug port and evaluate arbitrary JavaScript.

BIG-IP systems in a standard, default configuration are not vulnerable. This vulnerability requires the BIG-IP systems to be provisioned for iRulesLX and have a workspace that includes an extension configuration including the “–debug” flag, which must be manually added.