Privilege Escalation

Read more about the article F5 BIG-IP Next Central Manager: The Unauthenticated Takeover Bugs

F5 BIG-IP Next Central Manager: The Unauthenticated Takeover Bugs

On November 6, 2024, F5 disclosed a pair of critical bugs in BIG-IP Next Central Manager shipped in its SPK fabric: CVE-2024-23327, an unauthenticated privilege-escalation path reachable via REST API, and CVE-2024-23328, a missing-authentication flaw letting attackers create arbitrary administrator accounts. Together they enable full takeover of a management node that itself commands a fleet of application delivery hardware. This account walks both paths, the same-day patches, and the uncomfortable lineage going back to CVE-2022-1388’s iControl REST flaw.

Continue ReadingF5 BIG-IP Next Central Manager: The Unauthenticated Takeover Bugs
Read more about the article AST03: Over-Privileged Skills and the DROP TABLE Problem
OWASP Agentic Skills Top 10 series cover (cover_p4.png)

AST03: Over-Privileged Skills and the DROP TABLE Problem

AST03 of the OWASP Agentic Skills Top 10: the risk where nothing is malicious and the damage still lands. Permission checks fire at tool-call level, not intent - so a SELECT-permitted skill can DROP TABLE. With Meta's inbox-deletion incident, LPCI and LAAF research, and the per-skill credential controls that close the gap.

Continue ReadingAST03: Over-Privileged Skills and the DROP TABLE Problem