Fig 1. BF for CVE-2020-5902 – BIG-IP TMUI RCE
- DVL (Validate)
- Cause:
- Attributes:
- Mechanism:
.*\.\.;.*“ regular expression)- Source Code:
- Execution Space:
- State:
- Consequence:
- BIG-IP is a family of server-side products from F5 Inc. focused on availability, performance, and security. In several versions, its Traffic Management Interface (TMUI), known as the BIG-IP Configuration utility, allows Remote Code Execution (RCE).
- TMUI of BIG-IP accepts
/..;/ via the login interface /tmui/login.jsp. However, the Apache Tomcat treats /..;/ as /../, which is a relative path for going one directory up. This allows a malicious user to bypass authentication, save and open files, and run arbitrary commands on the host.- To fix the bug, input validation (e.g., via the ”
.*\.\.;.*” regular expression) should be added to reject any /..;/ elements.
Fig 2. BF for CVE-2019-10748 – Sequelize SQL Injection
- DVL (Sanitize)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
query-generator.js)- Execution Space:
- State:
- Object Location:
- Consequence:
- Sequelize is an Object-Relational Mapper for
Node.js. It supports Postgres, MySQL, MariaDB, SQLite, and Microsoft SQL Server; it facilitates transaction support, relations, and lazy loading. In several versions query-generator.js allows SQL injection.- User input path is not sanitized for MySQL/MariaDB syntax in a JSON (JavaScript Object Notation) object.
- To fix the bug, the developers check the input paths syntax and sanitize it.