F5 Big-IP – rsync Access

• Exploit Database
• 128 阅读

• 作者： Security-Assessment.com
  日期： 2014-08-29
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/34465/
• 1 2 3 4 5

  When configured in a high availability mode, the F5 solution suffers from an unauthenticated rsync access vulnerability that can be leveraged to upload a malicious SSH key and gain remote root access to the appliance. The BigIP platform configures an rsync daemon listening on the ConfigSync interfaces when the system is configured in a failover mode. The rsync daemon as currently configured does not require any authentication and the “cmi” module has complete read/write access to the system. If the ConfigSync IP addresses are accessible by a malicious third party, it is possible to upload an authorized_keys file directly into the /var/ssh/root directory and then open a root SSH session on the f5 device.   Advisory: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34465.pdf