NimbostratusDuring a PCI scan test the report has phpinfo Information Disclosure Vulnerability. This was reported on the Public IP of F5's Virtual server.
Can anyone suggest me how to get rid of this vulnerability? Currently the device is running with 11.6 Hotfix5.
Thank you in advance.
EmployeeIf it is on the public IP (presumably the self-IP) then you need to set your self-IP Port Lockdown to None so that externals can't get access to the management GUI.
NimbostratusGenerally this means the code on the pool member side contains a php_info() function call somewhere. If your security scanner exposed this vulnerability, it should also report the URL path returning the output of php_info(). If that URL path (better terminology is URI) is not essential to your application, then you can simply block it with an iRule returning an empty response.
when HTTP_REQUEST {
if { [HTTP::uri] starts_with "/your/unique/uri/which/is/vulnerable" } {
HTTP::respond 200 content ""
}
}Let me know if that helps
Christian
Nimbostratus