Monday, December 4, 2023

High-Severity RCE Bug in F5 Products Let Attackers Hack the Complete Systems

Experts from Rapid7 observed a customized CentOS installation operating on F5 BIG-IP and BIG-IQ devices found to have various vulnerabilities. 

While the other flaws are security bypass methods that F5 does not consider vulnerabilities, two of the vulnerabilities have been categorized as high-severity remote code execution vulnerabilities and given CVE IDs.

Vulnerabilities Discovered

The first high-severity flaw is tracked as (CVE-2022-41622) is an unauthenticated remote code execution via cross-site request forgery (CSRF) that impacts BIG-IP and BIG-IQ products.

In this case, even if a device’s management interface is not exposed to the internet, exploitation can still enable a remote, unauthenticated attacker to get root access.

“An attacker may trick users who have at least resource administrator role privilege and are authenticated through basic authentication in iControl SOAP into performing critical actions. An attacker can exploit this vulnerability only through the control plane, not through the data plane. If exploited, the vulnerability can compromise the complete system.” reads the advisory published by F5.

The report says exploitation requires the attacker to be familiar with the targeted network and to convince an administrator who is logged in to visit a malicious website that is designed to exploit.

This attack cannot be prevented if you have authenticated to iControl SOAP in the web browser with basic authentication. This authentication mechanism is uncommon and is different from using the login page for the Configuration utility.

F5 advises against using basic authentication for web browser authentication. Don’t enter credentials if a web browser authentication popup is on the web browser.

The second high-severity flaw, (CVE-2022-41800), enables an attacker with administrative rights to execute arbitrary shell commands via RPM specification files.

It resides in the Appliance mode iControl REST and is an authenticated remote code execution via RPM spec injection. An authenticated user with appropriate user credentials assigned to the Administrator role can bypass restrictions in Appliance mode.

“In Appliance mode, an authenticated user with valid user credentials assigned the Administrator role may be able to bypass Appliance mode restrictions. This is a control plane issue; there is no data plane exposure”, reads the advisory 

“Appliance mode is enforced by a specific license or may be enabled or disabled for individual Virtual Clustered Multiprocessing (vCMP) guest instances”.

In this case, F5 recommends temporary mitigations that reduce the threat surface by limiting access to iControl REST to only trustworthy networks or devices. 

In order to access a highly privileged administrative account, the attacker must possess the correct credentials. As a result, limiting access could still leave the device vulnerable to lateral movement from a hacked device within the trusted range or insider threat.

The following are the bypasses of security controls that F5 rejected because not exploitable, including two SELinux bypass techniques and a local privilege escalation via bad UNIX socket permissions.

Managed DDoS Attack Protection for Applications – Download Free Guide


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles