Christoffer Jerkeby - Load Balancer with RCE, Hacking F5

### Overview In this presentation, Christoffer Jerkeby reveals how improper programming practices in F5 BIG-IP load balancers' iRules scripting language lead to remote code execution (RCE). As a penetration tester at F-Secure in Stockholm, Jerkeby uncovered this vulnerability class during a client engagement where the customer used an F5 load balancer. Jerkeby notes that F5 SIRT confirmed the issue and issued an advisory to guide affected customers. The vulnerability does not stem from a software bug in the BIG-IP platform itself, but rather from widespread misconfigurations and unsafe coding patterns within user-written iRules scripts, which are often configured by networking teams rather than dedicated software developers.

### Key Topics - **TCL and iRules Heritage:** F5's iRules scripting language is a fork of Tool Command Language (TCL) 8.4, which dates back to 2005/2006. While modern languages have updated their syntax or security properties, iRules retains legacy TCL quirks regarding string handling and command evaluation. - **String Parsing and Argument Expansion:** In TCL/iRules, string representation dictates whether code executes. While curly braces (`{}`) treat content as literal strings, double quotes (`""`) permit variable substitution, hard brackets (`[]`) execute embedded commands (similar to bash backticks), and unquoted arguments can evaluate commands directly. - **Dangerous Functions:** Commands such as `eval`, `subst`, `expr`, `catch`, `after`, `while`, and `if` inherently evaluate or re-evaluate statements, creating severe command injection vulnerabilities when fed unvalidated user input. - **Exploitation and Pivoting:** Attackers can inject arbitrary commands via HTTP request components such as headers, cookies, or URI arguments. Because the load balancer sits after TLS termination, attackers can intercept cleartext traffic, pivot internally across internal network devices, scan ports, or abuse synchronized session tables across redundant appliances.

### Technical Details Jerkeby explains that attackers can recognize F5 BIG-IP devices by seeking `Server: BigIP` response headers on redirects, static error pages, or favicons, as well as specific load-balancing stickiness cookies. In demonstrations using Burp Suite, Jerkeby shows how injecting commands wrapped in hard brackets into an HTTP cookie or query parameter causes the device to evaluate the code.

Key demonstration examples include: - **Command Injection via Double Quotes & Brackets:** Injecting commands such as `[TCP::respond ...]` causes the load balancer to execute code and return a response before the backend server's payload is sent. Jerkeby notes that syntax errors are logged on the appliance, whereas clean, successful execution remains silent in the logs unless explicitly written to them using the `log` command. - **Introspection via `info level 0`:** By executing `info level 0`, an attacker can extract the running iRules source code directly from memory, revealing the exact logic and vulnerable functions. - **Cross-Session Table Poisoning:** In a DNS resolver example derived from a widely downloaded script on F5's DevCentral community repository, Jerkeby demonstrates injecting into a `table` command using semicolon statement separators (and avoiding switch statement parsing pitfalls). By inserting malicious payloads like `TCP::respond pwned` into shared session tables, subsequent lookups made by other users execute the cached command, enabling cross-session tampering, traffic hijacking, and credential/cookie theft. - **Internal Pivoting and SSRF:** Because BIG-IP sits on the network boundary, arbitrary command execution in an iRule enables arbitrary TCP connections, port scanning, acting as a SOCKS proxy, or accessing local files via `ifile`.

### Takeaways - **No Device Patch Available:** Jerkeby stresses that F5 cannot simply release a firmware patch to resolve this vulnerability, as removing core TCL behaviors like command substitution or expression evaluation would break existing iRules deployments globally. - **Source Code Auditing:** Penetration testers and organizations must perform source code audits on iRules rather than treating BIG-IP simply as a network appliance. - **Tooling for Remediation:** Organizations should audit and test their rules using `tclscan` (a tool written in Rust that Jerkeby updated to detect dangerous keywords and unquoted variables) integrated into Git commit hooks, as well as `testcl` (a Java-based unit testing framework for TCL/iRules logic and cookie handling).