K04234247 : Resource Administrator or Administrator role authenticated local command execution vulnerability CVE-2021-23012

Security Advisory Description

Lack of input validation for items used in system support functionality may allow users granted either “Resource Administrator” or “Administrator” roles to execute arbitrary bash commands on BIG-IP. (CVE-2021-23012)

Impact

In a standard BIG-IP deployment, a minor privilege escalation may be created when executed as the Resource Administrator. In an Appliance Mode deployment scenario this may allow for the aforementioned roles to execute shell commands to escape the Appliance Mode sandbox.