1. Introduction
The F5 Networks BIG-IP Web Interface Default Credential Check vulnerability means that an administrator interface on a remote F5 BIG-IP device is accessible using default credentials. This allows unauthorised access to the system, potentially leading to full control of the device and network traffic. Affected systems are typically those running F5 BIG-IP with the web administration interface enabled. A successful exploit could compromise confidentiality, integrity, and availability of the affected system and connected networks.
2. Technical Explanation
The vulnerability occurs because the administrative web interface is configured with a known default username (‘admin’) and password. Nessus successfully logged in using these credentials. An attacker can exploit this by attempting to log into the BIG-IP device’s web administration interface using the default credentials, gaining access without valid authentication. There are no specific CVE or vendor IDs associated with this particular check, as it is a basic security misconfiguration.
- Root cause: Use of default administrative credentials on the web interface.
- Exploit mechanism: An attacker attempts to log in using the ‘admin’ username and password.
- Scope: F5 Networks BIG-IP devices with the web administration interface enabled, running a version where default credentials are not changed.
3. Detection and Assessment
You can confirm if a system is vulnerable by attempting to log in using default credentials. A thorough method involves scanning for open ports associated with the web interface and then testing login attempts.
- Quick checks: Check if port 443 (HTTPS) is open, indicating the web interface is enabled.
- Scanning: Nessus plugin ID 16859 can detect this vulnerability. Other scanners may have similar plugins.
- Logs and evidence: Examine BIG-IP system logs for successful login attempts from unexpected sources using the ‘admin’ account.
# Example command placeholder:
# nmap -p 443
4. Solution / Remediation Steps
The solution is to change the default password for the ‘admin’ account on the BIG-IP device. Follow these steps carefully to avoid service disruption.
4.1 Preparation
- Services: No services need to be stopped for this change, but plan during low usage times.
- Dependencies: Ensure you have access credentials with sufficient privileges to modify system settings. Rollback is possible by restoring the previous backup if needed.
4.2 Implementation
- Step 1: Log in to the BIG-IP web administration interface using existing credentials.
- Step 2: Navigate to System > Account Management > Accounts.
- Step 3: Select the ‘admin’ account.
- Step 4: Change the password for the ‘admin’ account to a strong, unique value.
- Step 5: Confirm the new password and save the changes.
4.3 Config or Code Example
Before
# No password set, or default password in use.
After
# Strong, unique password set for 'admin' account.
4.4 Security Practices Relevant to This Vulnerability
Several security practices can help prevent this issue. Least privilege reduces the impact of compromised accounts. Safe defaults ensure systems start in a secure state. A strong password policy enforces complex passwords and regular changes.
- Practice 1: Implement least privilege by limiting access to administrative functions only to authorized personnel.
- Practice 2: Enforce safe defaults by requiring all new accounts to have strong, unique passwords upon creation.
4.5 Automation (Optional)
Automation is not recommended for this specific task due to the risk of locking out administrative access if incorrectly configured. Manual changes are preferred.
5. Verification / Validation
- Post-fix check: Attempt to log in with the new password – successful login confirms the change.
- Re-test: Re-run Nessus plugin 16859; it should no longer report the vulnerability.
# Post-fix command and expected output:
# Successful login to the BIG-IP web interface with the new credentials.
6. Preventive Measures and Monitoring
- Baselines: Update your security baseline to require strong, unique passwords for all administrative accounts.
- Pipelines: Add automated checks to your CI/CD pipeline to scan for default credentials in system configurations.
7. Risks, Side Effects, and Roll Back
- Risk or side effect 1: Incorrect password entry can lead to account lockout.
- Roll back: Restore the BIG-IP configuration from the pre-change backup.
8. References and Resources
- Vendor advisory or bulletin: http://www.nessus.org/u?ec6a297f