F5 Networks rsync RCE

High Nessus Plugin ID 78427


The remote host is running a rsync daemon that allows a user to upload arbitrary files.


The rsync daemon on the remote F5 Networks host is affected by an authentication bypass vulnerability when configured in failover mode.
An unauthenticated, remote attacker can exploit this, via a cmi request to the ConfigSync IP address, to read or write arbitrary files.

Nessus was able to confirm that a module on the remote rsync daemon allows writing files to the root of the file system. An attacker can overwrite '/root/.ssh/authorized_keys' and obtain ssh access, allowing the execution of arbitrary code with the privileges of the root user.


Disable the rsync daemon.

See Also



Plugin Details

Severity: High

ID: 78427

File Name: f5_rsync_rce.nasl

Version: $Revision: 1.4 $

Type: remote

Family: Misc.

Published: 2014/10/14

Modified: 2016/05/20

Dependencies: 78428

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/h:f5:big-ip

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 2014/08/28

Vulnerability Publication Date: 2014/08/28

Reference Information

CVE: CVE-2014-2927

BID: 69461

OSVDB: 110595

EDB-ID: 34465