A Brace Helps to Balance the Load

A syntax construct inside the TCL language is allowing injection attacks to occur.

Load balancers have the potential inside them for a real problem, its been discovered. It arises from the language used to control the load balancing, called Tool Command Language (TCL).
A senior security consultant for F-Secure, Christoffer Jerkeby, realized there was a problem with the language and first wrote a paper about the problem in May, with an update in June. Public attention was only drawn to the problem recently, with F-secure
posting to its blog
and F5 issuing a
security advisory
.
F5 is involved in this because TCL is used with its BIG-IP OS for load balancers so you can tell the puppy what you want it to do. BIG-IP is very popular with larger enterprises like banks.
Security Now talked with Jerkeby on whether this was a hypothetical attack, or based on real-world observations. He told SN that, I discovered this issue while performing a security assessment for a client, and have since verified it with other companies. However, we are not aware of any cases where it has been used in real attacks. Not yet, anyway.
Whats going on is a syntax construct (its actually a required feature that lets substitutions occur during the evaluation of statements) inside the TCL language that can allow injection attacks to occur. As F5 put it, The design of the Tcl language allows for substitutions in statements and commands and this feature of Tcl can allow injection attacks similar to those seen in SQL or shell scripting languages, where arbitrary user input is interpreted as code and executed.
Because its in the language itself, it cannot be patched. Also, the problem may not affect every installation. You have to check your particular balancer to see if the way it was programmed before being put into production will leave it open to this exploit. Did I mention that a Shodan search turned up 300,000 worldwide active BIG-IP implementations with 60% of them in the US? Theres the potential for big stuff here.
Lets get something straight. Like the advisory says, This is not a vulnerability in Tcl, or F5 products, but rather an issue relating to coding practices used when writing Tcl code.
So, F5 cant make users write bulletproof code. But they can call them out on it when they dont. The mitigation is that expressions in Tcl should always be braced. This may be as simple as enclosing the expression in curly braces {}.
There are some open source tools on GitHub for those who have the touch to try things on their installations. A
BIG-IP tester
will look at what rules you now have in place, though
the documentation
says its for “when you dont have the balls to test your iRules directly in production.”
An
automated scan tool
that will pick the vulnerable implementations out of a network is also available.
— Larry Loeb has written for many of the last centurys major dead tree computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Last News
▸ Black Hat 2013 trainings focus on Incident Response and Malware. ◂ Discovered: 26/12/2024 Category: security	▸ Black Hat 2013 highlights Home Security, Bootkits, Cell OPSEC shortcomings. ◂ Discovered: 26/12/2024 Category: security	▸ Google and DISA start User ID project. ◂ Discovered: 26/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
A Brace Helps to Balance the Load