Friday, May 24, 2024

High-Severity RCE Bug in F5 Products Let Attackers Hack the Complete Systems

Experts from Rapid7 observed a customized CentOS installation operating on F5 BIG-IP and BIG-IQ devices found to have various vulnerabilities. 

While the other flaws are security bypass methods that F5 does not consider vulnerabilities, two of the vulnerabilities have been categorized as high-severity remote code execution vulnerabilities and given CVE IDs.

Vulnerabilities Discovered

The first high-severity flaw is tracked as (CVE-2022-41622) is an unauthenticated remote code execution via cross-site request forgery (CSRF) that impacts BIG-IP and BIG-IQ products.

In this case, even if a device’s management interface is not exposed to the internet, exploitation can still enable a remote, unauthenticated attacker to get root access.

“An attacker may trick users who have at least resource administrator role privilege and are authenticated through basic authentication in iControl SOAP into performing critical actions. An attacker can exploit this vulnerability only through the control plane, not through the data plane. If exploited, the vulnerability can compromise the complete system.” reads the advisory published by F5.

The report says exploitation requires the attacker to be familiar with the targeted network and to convince an administrator who is logged in to visit a malicious website that is designed to exploit.

This attack cannot be prevented if you have authenticated to iControl SOAP in the web browser with basic authentication. This authentication mechanism is uncommon and is different from using the login page for the Configuration utility.

F5 advises against using basic authentication for web browser authentication. Don’t enter credentials if a web browser authentication popup is on the web browser.

The second high-severity flaw, (CVE-2022-41800), enables an attacker with administrative rights to execute arbitrary shell commands via RPM specification files.

It resides in the Appliance mode iControl REST and is an authenticated remote code execution via RPM spec injection. An authenticated user with appropriate user credentials assigned to the Administrator role can bypass restrictions in Appliance mode.

“In Appliance mode, an authenticated user with valid user credentials assigned the Administrator role may be able to bypass Appliance mode restrictions. This is a control plane issue; there is no data plane exposure”, reads the advisory 

“Appliance mode is enforced by a specific license or may be enabled or disabled for individual Virtual Clustered Multiprocessing (vCMP) guest instances”.

In this case, F5 recommends temporary mitigations that reduce the threat surface by limiting access to iControl REST to only trustworthy networks or devices. 

In order to access a highly privileged administrative account, the attacker must possess the correct credentials. As a result, limiting access could still leave the device vulnerable to lateral movement from a hacked device within the trusted range or insider threat.

The following are the bypasses of security controls that F5 rejected because not exploitable, including two SELinux bypass techniques and a local privilege escalation via bad UNIX socket permissions.

Managed DDoS Attack Protection for Applications – Download Free Guide


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles