F5OS SSH Key-Based Authentication Vulnerability in Appliance Mode

A vulnerability exists in F5OS systems that allows SSH key-based authentication to remain active even after Appliance Mode is enabled. This issue arises when the root user initially configures the system for SSH key-based logins and later activates Appliance Mode. To exploit this vulnerability, an attacker must obtain the root user's SSH private key, corresponding to a key listed in the authorized_keys file.

Impact

Exploitation of this vulnerability could allow an attacker with access to a root user's SSH private key to log into the F5OS system while it is in Appliance Mode, bypassing the intended access controls.

Remediation

To address this vulnerability, remove all configured public keys from the root user's authorized_keys file before enabling Appliance Mode. For F5OS-C users, an engineering hotfix is available. This hotfix can be downloaded from the MyF5 Downloads page.