Symptoms

The APM logon page accepted usernames with special characters that are invalid according to the Microsoft SAM-Account-Name specification. No input validation was enforced on the logon page, which could allow invalid or potentially malicious characters in the username fields

Impact

Users could submit usernames containing characters such as "/", "[", "]", ":", ";", "|", "=", ",", "+", "*", "?", "<", and ">" through the APM login page without any validation. This lack of validation could lead to unexpected behavior during the subsequent authentication process with Active Directory

Conditions

This occurs when using an APM policy with a Logon Page agent (e.g., SimpleLogonPage) on any BIG-IP platform

Workaround

None

Fix Information

The APM logon page now sanitizes user input by rejecting the following special characters that are invalid in SAM-Account-Name values: " / [ ] : ; | = , + * ? < >. The backslash (\) is still permitted as it is used as a domain separator in usernames (e.g., DOMAIN\user)

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips