“The preliminary vector is a SQL Injection within the login kind,” Vlad Babkin, the Eclypsium security researcher who discovered the flaw, advised CSO. “Theoretically it must be doable to bypass the login, however we felt our proof of exploitability was ample to diagnose the vulnerability.”
Weak hashes contributed to vulnerability
In concept cryptographic hashes shouldn’t be reversible and they’re the beneficial technique of storing passwords inside databases. In observe, nonetheless, their security relies on the hashing algorithm used — some have identified vulnerabilities and are thought-about insecure — the settings used for the operation, the size of the plaintext passwords that had been hashed, and the computing energy obtainable to the attacker.
On this case, the BIG-IP Subsequent Central Supervisor used the bcrypt algorithm for hashing however used with a price issue setting of 6, which in response to the Eclypsium researchers is simply too low in comparison with fashionable suggestions and on this simplifies brute-force hash cracking assaults.
It’s price noting that many cryptographic algorithms have settings to be executed a number of rounds with a view to improve brute-force issue and the advice will change over time as computing energy will increase and turns into extra available.
Whereas efficiently cracking a password hash does rely upon its complexity and size, “a well-funded attacker (~$40k-$50k) can simply attain brute-force speeds of tens of millions of passwords per second,” the Eclypsium researchers stated.
Extra points had been recognized by researchers
If an attacker manages to achieve administrative entry on the Central Supervisor they’ll exploit one other server-side request forgery (SSRF) subject discovered by Eclypsium to name API strategies obtainable on BIG-IP Subsequent units managed from the Central Supervisor. One in all these strategies permits the creation of on-board accounts on the units that ought to not usually exist, and which wouldn’t be seen from the Central Supervisor.
