DIVD-2022-00027 - F5 BIG-IP iControl REST API remote code execution

Summary

Days after F5 released patches for a critical remote code execution vulnerability affecting its BIG-IP family of products, a proof of concept exploit code has been released for the vulnerability with attribute CVE-2022-1388. In addition, abuse of this vulnerability has been reported. Organisations are urged to install the updates made available by F5 or to apply mitigating measures.

Impact

By leveraging the vulnerability, an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services.

What you can do

• We recommend you to remediate the vulnerability by following F5’s advisory

Fixes are available in versions 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, and 13.1.5. Firmware versions 11.x and 12.x will not receive any security updates. You can:

• Block iControl REST access through the self IP address
• Block iControl REST access through the management interface, and
• Modify the BIG-IP httpd configuration

or

• Take the instance offline

• Inspect your instance for backdoors, miners if possible. We recommend you to eliminate any possibilities or malware remaining on the server.

What we are doing

• DIVD is currently ensuring that the owners of vulnerable systems are being notified. We do this by scanning for vulnerable hosts, verifying the vulnerability and notifying the owners of these systems. If you receive an email from us regarding this case, the vulnerability has been confirmed.
• We validate the vulnerability by executing a non-existent command and match the response.

Timeline

More information

• Security Advisory
• Big IP Security advice