K44885536 : iControl REST vulnerability CVE-2019-6622

Security Advisory Description

Undisclosed iControl REST worker is vulnerable to command injection by an administrator or resource administrator user. This attack is only exploitable on multi-bladed systems.

The vulnerability allows bypass of Appliance mode security on BIG-IP systems by allowing the execution of arbitrary Advanced Shell (bash) commands. In systems without Appliance mode security, the administrator and resource administrator users will likely have this level of access already. F5 considers this a security concern mostly for systems deployed in Appliance mode, but it’s also a valid attack vector for users that do not already have bash access granted. For example, a resource administrator who does not already have bash access explicitly granted in the user configuration can be exploited as an attack vector. (CVE-2019-6622)

Impact

A remote attacker can exploit the vulnerability by executing arbitrary bash commands on a vulnerable multi-bladed system.