Threat video1:00
CVE-2020-26116 F5 Python CRLF Flaw: Detection & IOCs
F5 BIG-IP Next SPK, BIG-IQ and F5OS inherit Python's http[.]client CRLF flaw; no exploitation reported. 9 detection rules, 12 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2020-26116 F5 Python CRLF Flaw: Detection & IOCs →
Chapters
- 0:00The hookCRLF injection affects 4 F5 products.
- 0:04The storyCRLF injection discovered in Python.
- 0:11Attack pathIn F5 products, Python's http[.]client has a CRLF injection flaw.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise7 indicators to hunt: 5 hashes, 1 package name and 1 path.
- 0:38MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to impact.
- 0:43Remediation3 steps now: Review F5 advisory.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00CRLF injection affects 4 F5 products.
0:05CRLF injection discovered in Python.
0:08Now surfaces in F5 products.
0:12In F5 products, Python's http[.]client has a CRLF injection flaw.
0:18Attackers can embed carriage-return and line-feed characters in the HTTP method.
0:27No threat actor is attributed. Confidence: low.
0:327 indicators to hunt: 5 hashes, 1 package name and 1 path.
0:385 ATT&CK techniques, from initial access to impact.
0:433 steps now: Review F5 advisory.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.