F5 Networks rsync RCE
High Nessus Plugin ID 78427
SynopsisThe remote host is running a rsync daemon that allows a user to upload arbitrary files.
DescriptionThe rsync daemon on the remote F5 Networks host is affected by an authentication bypass vulnerability when configured in failover mode.
An unauthenticated, remote attacker can exploit this, via a cmi request to the ConfigSync IP address, to read or write arbitrary files.
Nessus was able to confirm that a module on the remote rsync daemon allows writing files to the root of the file system. An attacker can overwrite '/root/.ssh/authorized_keys' and obtain ssh access, allowing the execution of arbitrary code with the privileges of the root user.
SolutionDisable the rsync daemon.