CVE-2017-6145 Auth bypass in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe

High 7.3 Published 20 Oct 2017 Updated 16 Sep 2024

Attackers can use expired authentication cookies to obtain valid tokens, bypassing session expiration controls in F5 BIG-IP devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-6145?

CVE-2017-6145 is a high-severity authentication bypass vulnerability in F5 Big-Ip Access Policy Manager, published on 20 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.

Weakness: CWE-613

Which versions are affected by CVE-2017-6145?

It affects 10 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System and 4 more.

How do I fix CVE-2017-6145?

No fix has been published for CVE-2017-6145 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2017-6145 being exploited?

There is no known exploitation of CVE-2017-6145 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-mfh8-v6rj-qxf5.