Experts from Rapid7 observed a customized CentOS installation operating on F5 BIG-IP and BIG-IQ devices found to have various vulnerabilities.
While the other flaws are security bypass methods that F5 does not consider vulnerabilities, two of the vulnerabilities have been categorized as high-severity remote code execution vulnerabilities and given CVE IDs.
Vulnerabilities Discovered
The first high-severity flaw is tracked as ( CVE-2022-41622 ) is an unauthenticated remote code execution via cross-site request forgery (CSRF) that impacts BIG-IP and BIG-IQ products.
In this case, even if a device’s management interface is not exposed to the internet, exploitation can still enable a remote, unauthenticated attacker to get root access.
“An attacker may trick users who have at least resource administrator role privilege and are authenticated through basic authentication in iControl SOAP into performing critical actions. An attacker can exploit this vulnerability only through the control plane, not through the data plane. If exploited, the vulnerability can compromise the complete system.” reads the advisory published by F5.
The report says exploitation requires the attacker to be familiar with the targeted network and to convince an administrator who is logged in to visit a malicious website that is designed to exploit.
This attack cannot be prevented if you have authenticated to iControl SOAP in the web browser with basic authentication. This authentication mechanism is uncommon and is different from using the login page for the Configuration utility.
F5 advises against using basic authentication for web browser authentication. Don’t enter credentials if a web browser authentication popup is on the web browser.
The second high-severity flaw, ( CVE-2022-41800 ), enables an attacker with administrative rights to execute arbitrary shell commands via RPM specification files.
It resides in the Appliance mode iControl REST and is an authenticated remote code execution via RPM spec injection. An authenticated user with appropriate user credentials assigned to the Administrator role can bypass restrictions in Appliance mode.
“In Appliance mode, an authenticated user with valid user credentials assigned the Administrator role may be able to bypass Appliance mode restrictions. This is a control plane issue; there is no data plane exposure”, reads the advisory
“Appliance mode is enforced by a specific license or may be enabled or disabled for individual Virtual Clustered Multiprocessing (vCMP) guest instances”.
In this case, F5 recommends temporary mitigations that reduce the threat surface by limiting access to iControl REST to only trustworthy networks or devices.
In order to access a highly privileged administrative account, the attacker must possess the correct credentials. As a result, limiting access could still leave the device vulnerable to lateral movement from a hacked device within the trusted range or insider threat.
The following are the bypasses of security controls that F5 rejected because not exploitable, including two SELinux bypass techniques and a local privilege escalation via bad UNIX socket permissions.
Managed DDoS Attack Protection for Applications – Download Free Guide
The post High-Severity RCE Bug in F5 Products Let Attackers Hack the Complete Systems appeared first on GBHackers - Latest Cyber Security News | Hacker News .
Top News
-
Tăng cường ứng dụng AI trong kinh doanh và an ninh mạng
Vừa qua Cloud Ace, Google Cloud và SAP đã tổ chức hội thảo “Tăng cường ứng dụng AI trong kinh doanh và an ninh mạng”, giới thiệu những giải pháp...
-
Lỗ hổng RCE trong máy chủ tệp Rejetto HTTP, đã có PoC
Lỗ hổng CVE-2024-23692 vừa được phát hiện trong các phiên bản Rejetto HTTP File Server (HFS) 2.x, ảnh hưởng các tổ chức và cá nhân sử dụng phần...
-
Snowflake Breach Exposes 165 Customers' Data in Ongoing Extortion Campaign
As many as 165 customers of Snowflake are said to have had their information potentially exposed as part of an ongoing campaign designed to...
-
Arm Warns Of Mali GPU Kernel Driver Flaws Exploited In The Wild
The Mali GPU driver is a widely used Graphical Processing Unit for multiple devices, including Android and Linux. A new vulnerability has...