Researchers Develop RCE Exploit for the Latest F5 BIG-IP Vulnerability

Days after F5 released patches for a critical remote code execution vulnerability affecting its BIG-IP family of products, security researchers are warning that they were able to create an exploit for the shortcoming.

Tracked CVE-2022-1388 (CVSS score: 9.8), the flaw relates to an iControl REST authentication bypass that, if successfully exploited, could lead to remote code execution, allowing an attacker to gain initial access and take control of an affected system.

This could range anywhere from deploying cryptocurrency miners to dropping web shells for follow-on attacks, such as information theft and ransomware.

“We have reproduced the fresh CVE-2022-1388 in F5’s BIG-IP,” cybersecurity company Positive Technologies said in a tweet on Friday. “Patch ASAP!”

The critical security vulnerability impacts the following versions of BIG-IP products -

• 16.1.0 - 16.1.2
• 15.1.0 - 15.1.5
• 14.1.0 - 14.1.4
• 13.1.0 - 13.1.4
• 12.1.0 - 12.1.6
• 11.6.1 - 11.6.5

Fixes are available in versions 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, and 13.1.5. Firmware versions 11.x and 12.x will not receive security updates and users relying on those versions should consider upgrading to a newer version or apply the workarounds -

• Block iControl REST access through the self IP address
• Block iControl REST access through the management interface, and
• Modify the BIG-IP httpd configuration

Last month, cybersecurity authorities from Australia, Canada, New Zealand, the U.K., and the U.S. jointly warned that threat actors are aggressively targeting “newly disclosed critical software vulnerabilities against broad target sets, including public and private sector organizations worldwide.”

With the F5 BIG-IP flaw found trivial to exploit, malicious hacking crews are expected to follow suit, making it imperative that affected organizations move quickly to apply the patches.

Update: Security researcher Kevin Beaumont has warned of active exploitation attempts detected in the wild, while simultaneously alerting the availability of a public proof-of-concept (PoC) for the code execution flaw.

Found this article interesting? Follow THN on Facebook, Twitter  and LinkedIn to read more exclusive content we post.