CVE-2024-39809: F5 BIG-IP Auth Bypass Vulnerability

CVE-2024-39809 Overview

CVE-2024-39809 is a session management vulnerability in F5 BIG-IP Next Central Manager. The refresh token issued for a user session remains valid after the user logs out. An attacker who obtains a valid refresh token can continue to generate new authenticated sessions, defeating the logout boundary that users expect to terminate access.

The flaw is tracked under CWE-613: Insufficient Session Expiration and affects BIG-IP Next Central Manager version 20.1.0. F5 does not evaluate software versions that have reached End of Technical Support (EoTS).

Critical Impact

A stolen or intercepted refresh token retains validity past logout, allowing attackers to maintain authenticated access to the Central Manager and the BIG-IP infrastructure it manages.

Affected Products

• F5 BIG-IP Next Central Manager 20.1.0
• Deployments using the Central Manager web UI for centralized BIG-IP Next administration
• Environments where refresh tokens may be exposed through browser storage, logs, or proxies

Discovery Timeline

• 2024-08-14 - CVE-2024-39809 published to NVD
• 2024-08-19 - Last updated in NVD database

Technical Details for CVE-2024-39809

Vulnerability Analysis

The BIG-IP Next Central Manager uses an OAuth-style token model that issues a short-lived access token alongside a longer-lived refresh token. When a user explicitly logs out, the Central Manager fails to invalidate the refresh token server-side. The token remains accepted by the authentication endpoint until its natural expiration.

An attacker who captures a refresh token through phishing, malware on a client workstation, a man-in-the-middle position, or browser artifact recovery can replay it after the legitimate user logs out. Each replay yields a fresh access token, granting administrative reach over BIG-IP Next instances managed by the Central Manager.

The vulnerability is exploitable over the network but requires user interaction and high attack complexity, reflected in the CVSS 4.0 vector reporting attack requirements and user interaction conditions. The impact spans confidentiality, integrity, and availability for both the vulnerable component and downstream managed systems.

Root Cause

The root cause is the absence of a server-side token revocation step in the logout workflow. The application terminates the client-side session and invalidates the access token but does not add the corresponding refresh token to a revocation list or delete it from the token store. Stateless validation then continues to accept the token as legitimate.

Attack Vector

An attacker must first obtain a valid refresh token belonging to an authenticated administrator. The token can be replayed against the /refresh endpoint to mint new access tokens repeatedly. Because logout does not revoke the token, the legitimate user has no reliable way to terminate the attacker's session. Refer to the F5 Security Advisory K000140111 for vendor technical details.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-39809

Indicators of Compromise

• Refresh token usage from a client IP address or user-agent that differs from the original session origin
• Token refresh requests occurring after the user's logout event was recorded in audit logs
• Multiple concurrent active sessions tied to the same administrator account across distinct source addresses

Detection Strategies

• Correlate Central Manager audit logs for logout events with subsequent token/refresh activity for the same subject identifier
• Alert on access tokens issued outside the originating session's IP or geolocation
• Baseline normal administrator session duration and flag refresh chains that exceed it

Monitoring Recommendations

• Forward Central Manager authentication and authorization logs to a centralized SIEM for retention and correlation
• Monitor administrative API calls to BIG-IP Next instances for activity originating from tokens issued after a logout
• Review session inventory regularly and revoke long-lived tokens that lack a clear operational purpose

How to Mitigate CVE-2024-39809

Immediate Actions Required

• Apply the fixed version of BIG-IP Next Central Manager identified in F5 article K000140111
• Force a global session and token reset for all Central Manager administrators after patching
• Restrict Central Manager management interface access to trusted administrative networks only
• Enforce multi-factor authentication for all Central Manager administrator accounts

Patch Information

F5 provides remediation guidance and fixed software versions in Security Advisory K000140111. Administrators running version 20.1.0 should upgrade to a vendor-supplied fixed release. Versions that have reached End of Technical Support are not evaluated and should be replaced.

Workarounds

• Reduce the configured refresh token lifetime to the minimum value supported by the platform
• Terminate active administrator sessions on a fixed schedule to limit the value of any captured token
• Place the Central Manager UI behind a reverse proxy or VPN that enforces additional authentication and source restrictions

# Configuration example: restrict Central Manager UI exposure with a host firewall rule
# Replace 10.10.0.0/24 with the trusted administrative subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP