Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV

8/13/2019
10:45 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

A Brace Helps to Balance the Load

A syntax construct inside the TCL language is allowing injection attacks to occur.

Load balancers have the potential inside them for a real problem, it's been discovered. It arises from the language used to control the load balancing, called Tool Command Language (TCL).

A senior security consultant for F-Secure, Christoffer Jerkeby, realized there was a problem with the language and first wrote a paper about the problem in May, with an update in June. Public attention was only drawn to the problem recently, with F-secure posting to its blog and F5 issuing a security advisory.

F5 is involved in this because TCL is used with its BIG-IP OS for load balancers so you can tell the puppy what you want it to do. BIG-IP is very popular with larger enterprises like banks.

Security Now talked with Jerkeby on whether this was a hypothetical attack, or based on real-world observations. He told SN that, "I discovered this issue while performing a security assessment for a client, and have since verified it with other companies. However, we are not aware of any cases where it has been used in real attacks." Not yet, anyway.

What's going on is a syntax construct (it's actually a required feature that lets substitutions occur during the evaluation of statements) inside the TCL language that can allow injection attacks to occur. As F5 put it, "The design of the Tcl language allows for substitutions in statements and commands and this feature of Tcl can allow injection attacks similar to those seen in SQL or shell scripting languages, where arbitrary user input is interpreted as code and executed."

Because it's in the language itself, it cannot be patched. Also, the problem may not affect every installation. You have to check your particular balancer to see if the way it was programmed before being put into production will leave it open to this exploit. Did I mention that a Shodan search turned up 300,000 worldwide active BIG-IP implementations with 60% of them in the US? There's the potential for big stuff here.

Let's get something straight. Like the advisory says, "This is not a vulnerability in Tcl, or F5 products, but rather an issue relating to coding practices used when writing Tcl code."

So, F5 can't make users write bulletproof code. But they can call them out on it when they don't. The mitigation is that expressions in Tcl should always be "braced." This may be as simple as enclosing the expression in curly braces '{}'.

There are some open source tools on GitHub for those who have the "touch" to try things on their installations. A BIG-IP tester will look at what rules you now have in place, though the documentation says it's for “when you don't have the balls to test your iRules directly in production.”

An automated scan tool that will pick the vulnerable implementations out of a network is also available.

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/13/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14174
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5....
CVE-2019-20901
PUBLISHED: 2020-07-13
The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.
CVE-2019-20898
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.
CVE-2019-20899
PUBLISHED: 2020-07-13
The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.
CVE-2019-20900
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0.