High-Severity RCE Bug in F5 Products Let Attackers Hack the Complete Systems

Experts from Rapid7 observed a customized CentOS installation operating on F5 BIG-IP and BIG-IQ devices found to have various vulnerabilities. 

While the other flaws are security bypass methods that F5 does not consider vulnerabilities, two of the vulnerabilities have been categorized as high-severity remote code execution vulnerabilities and given CVE IDs.

Vulnerabilities Discovered

The first high-severity flaw is tracked as (CVE-2022-41622) is an unauthenticated remote code execution via cross-site request forgery (CSRF) that impacts BIG-IP and BIG-IQ products.

In this case, even if a device’s management interface is not exposed to the internet, exploitation can still enable a remote, unauthenticated attacker to get root access.

“An attacker may trick users who have at least resource administrator role privilege and are authenticated through basic authentication in iControl SOAP into performing critical actions. An attacker can exploit this vulnerability only through the control plane, not through the data plane. If exploited, the vulnerability can compromise the complete system.” reads the advisory published by F5.

The report says exploitation requires the attacker to be familiar with the targeted network and to convince an administrator who is logged in to visit a malicious website that is designed to exploit.

This attack cannot be prevented if you have authenticated to iControl SOAP in the web browser with basic authentication. This authentication mechanism is uncommon and is different from using the login page for the Configuration utility.

F5 advises against using basic authentication for web browser authentication. Don’t enter credentials if a web browser authentication popup is on the web browser.

The second high-severity flaw, (CVE-2022-41800), enables an attacker with administrative rights to execute arbitrary shell commands via RPM specification files.

It resides in the Appliance mode iControl REST and is an authenticated remote code execution via RPM spec injection. An authenticated user with appropriate user credentials assigned to the Administrator role can bypass restrictions in Appliance mode.

“In Appliance mode, an authenticated user with valid user credentials assigned the Administrator role may be able to bypass Appliance mode restrictions. This is a control plane issue; there is no data plane exposure”, reads the advisory 

“Appliance mode is enforced by a specific license or may be enabled or disabled for individual Virtual Clustered Multiprocessing (vCMP) guest instances”.

In this case, F5 recommends temporary mitigations that reduce the threat surface by limiting access to iControl REST to only trustworthy networks or devices. 

In order to access a highly privileged administrative account, the attacker must possess the correct credentials. As a result, limiting access could still leave the device vulnerable to lateral movement from a hacked device within the trusted range or insider threat.

The following are the bypasses of security controls that F5 rejected because not exploitable, including two SELinux bypass techniques and a local privilege escalation via bad UNIX socket permissions.

Managed DDoS Attack Protection for Applications – Download Free Guide