F5 BIG-IP and BIG-IQ Directory Traversal Vulnerability Allowing Unauthorized File Access

A directory traversal vulnerability has been identified in the F5 BIG-IP Configuration utility and is present in certain versions of BIG-IP through 17.5.1, 16.1.0 to 16.1.6, and 15.1.0 to 15.1.10. This vulnerability allows authenticated attackers to access files outside of the intended directories. The issue arises from improper neutralization of expression or command delimiters, enabling access to arbitrary files on the system.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the system, potentially allowing for further attacks or information disclosure.

Remediation

Users can upgrade to BIG-IP versions 17.5.1.3, 17.1.3, 16.1.6.1, or 15.1.10.8 to address this vulnerability. For more information about managing BIG-IP product hotfixes, refer to the F5 article K13123.