F5 BIG-IP CVE-2022-1388: the box in front of the apps

CVE-2022-1388, in F5 BIG-IP's iControl REST management API: some requests could bypass authentication entirely. F5 and NVD score it 9.8.

CISA flags known ransomware use, and listed it among the twelve vulnerabilities most routinely exploited in 2022.

The attacker needs to reach iControl REST, on the management port or on one of the box's self IP addresses. No account. Low complexity.

CISA rated it automatable, and warned of widespread exploitation because of how easy it was.

The management API is supposed to check who is asking. Here, certain requests skipped that check. From then on, system commands run on the box.

And everything behind it, the web applications, the VPN, the APIs, goes through that one box.

Arbitrary system commands. Files created or deleted, and services stopped. Control of a device that application traffic goes through.

And F5 warns that a skilled attacker can erase the evidence, so if in doubt, treat the box as compromised.

Upgrade to a fixed release: 16.1.2.2, 15.1.5.1, 14.1.4.6 or 13.1.5. Versions 12.1 and 11.6 will never be fixed.

Until you patch, set Port Lockdown to Allow None on every self IP, and keep the management interface on trusted networks only.

And CISA's advice for a box that was exposed: assume compromise, reimage it, and issue new credentials.

NacTrack reads each BIG-IP's version and matches it against the published advisories, with CISA's known exploited flag.

Sources: CISA KEV, F5 K23605346, NVD, CISA AA22-138A and AA23-215A.

Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.