{"uuid": "f293705a-601f-4970-a244-8f9db925c83a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-23008", "type": "seen", "source": "https://t.me/hacking_Attack/6936", "content": "Black Hat Ethical Hacking\nF5 Big-IP Vulnerable to Security-Bypass Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg F5 Big-IP Vulnerable to Security-Bypass BugPost Views: 98 \nReading Time: 1 Minute\nThe KDC-spoofing flaw tracked as CVE-2021-23008 can be used to bypass Kerberos security and sign into the Big-IP Access Policy Manager or admin console.\nF5 Networks\u2019 Big-IP Application Delivery Services appliance contains a Key Distribution Center (KDC) spoofing vulnerability, researchers disclosed \u2013 which an attacker could use to get past the security measures that protect sensitive workloads.\n\nSpecifically, an attacker could exploit the flaw (tracked as CVE-2021-23008) to bypass Kerberos security and sign into the Big-IP Access Policy Manager, according to researchers at Silverfort. Kerberos is a network authentication protocol that\u2019s designed to provide strong authentication for client/server applications by using secret-key cryptography. In some cases, the bug can be used to bypass authentication to the Big-IP admin console as well, they added.\n\nIn either case, a cybercriminal could gain unfettered access to Big-IP applications, without having legitimate credentials.\n\nThe potential impact could be significant: F5 provides enterprise networking to some of the largest tech companies in the world, including Facebook, Microsoft and Oracle, as well as to a trove of Fortune 500 companies, including some of the world\u2019s biggest financial institutions and ISPs.\nSee Also: Google Chrome V8 Bug Allows Remote Code-Execution CVE-2021-23008 SpecificsThe vulnerability specifically exists in one of the core software components of the appliance: The Access Policy Manager (APM). It manages and enforces access policies, i.e., making sure all users are authenticated and authorized to use a given application. Silverfort researchers noted that APM is sometimes used to protect access to the Big-IP admin console too.\n\nAPM implements Kerberos as an authentication protocol for authentication required by an APM policy, they explained.\n\n\u201cWhen a user accesses an application through Big-IP, they may be presented with a captive portal and required to enter a username and password,\u201d researchers said, in a blog posting issued on Thursday. \u201cThe username and password are verified against Active Directory with the Kerberos protocol to ensure the user is who they claim they are.\u201d\n\nDuring this process, the user essentially authenticates to the server, which in turn authenticates to the client. To work properly, KDC must also authenticate to the server. KDC is a network service that supplies session tickets and temporary session keys to users and computers within an Active Directory domain.\n\n\u201cApparently, KDC authentication to the server is often overlooked,\u201d researchers said. \u201cPerhaps because requiring it complicates configuration requirements. However, if the KDC does not authenticate to the server, the security of the protocol is entirely compromised, allowing an attacker that hijacked network traffic to authenticate to Big-IP with any password, even an invalid one.\u201d\n\nF5\u2019s instructions for configuring Active Directory authentication for an access policy do not include this last step.\n\n\u201cWhen a user attempts to authenticate to an app sitting behind the proxy, the user is challenged to enter a username and password. When the user enters their password, the product uses Kerberos to authenticate to the domain controller (DC). However, APM does not request a service ticket and grants access based on a successful AS_REP.\u201d\n\nAlso, F5 allows users to configure an admin username and password, which if were used to authenticate to the DC, prevents the vulnerability. Alas,[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:44.829225Z"}