This bulletin was written by Yann Lehmann of the Kudelski Security Threat Detection & Research Team
Update May 18th, 2022, 1800h UTC (2PM EDT)
According to a recent report from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center (MS-ISAC) released on May 18th, exploitation of the vulnerability has been observed on both government and private sector’s network.
Several POCs of exploits have since been released to the public, making the exploitation of that vulnerability much more accessible, including to less sophisticated actors. The Cyber Fusion Center (CFC) strongly urges its clients to apply the required patches to their affected devices. If any BIG-IP’s management ports or self IPs are or were publicly exposed, the CFC recommends to consider those devices as compromised and hunt for malicious activity. CISA and MS-ISAC have provided numbers of signatures for that purpose in the “Detection Methods” of the following CyberSecurity Advisory.
Summary
iControl REST is an evolution of F5 iControl framework. Leveraging this Representational State Transfer (REST) API, an authenticated user can accomplish anything that can be accomplished from the F5 BIG-IP command line. It is an extremely powerful API.
On May 04, 2022, F5 disclosed a critical CVE, CVE-2022-1388. It may allow an unauthenticated attacker with network access to the management port or the self IP addresses of the BIG-IP system to leverage the iControl REST component. This is because some requests to iControl REST can directly bypass the authentication mechanism. Due to the capabilities of this component, anyone with network access to the management port or the self IP addresses can execute arbitrary system commands and modify services or files. From the nature of the iControl rest component, this is a control plane vulnerability that does not expose the data plane.
At the time of writing there is no publicly known exploit of that vulnerability and F5 did not disclose any details on the requests that are able to bypass the iControl REST authentication. Moreover, with a good architectural design of the BIG-IP appliances the management port and the self IP addresses should not be directly exposed without control. However, according to CFC experience, such undisclosed requests are frequently quickly reversed-engineered by security researchers and malicious actors. As such the CFC recommends mitigating the risk immediately by patching. In addition, two others less-impacting vulnerabilities, CVE-2022-26415 and CVE-2022-29474, will also be mitigated by patching.
Affected Systems
This CVE-2022-1388 impacts only the following BIG-IP versions.
| Branch | Vulnerable Version | Fix introduced in | Severity / CVSSv3 | Impacted component |
| 16.x | 16.1.0 – 16.1.2 | 16.1.2.2 | Critical / 9.8 | iControl REST |
| 15.x | 15.1.0 – 15.1.5 | 15.1.5.1 | Critical / 9.8 | iControl REST |
| 14.x | 14.1.0 – 14.1.4 | 14.1.4.6 | Critical / 9.8 | iControl REST |
| 13.x | 13.1.0 – 13.1.4 | 13.1.5 | Critical / 9.8 | iControl REST |
| 12.x | 12.1.0 – 12.1.6 | Will not fix | Critical / 9.8 | iControl REST |
| 11.x | 11.6.1 – 11.6.5 | Will not fix | Critical / 9.8 | iControl REST |
If you are running a later component that the one mentioned in the fixed column above, that version should contain the fix and you are not impacted.
Solution
F5 provided fixes for the most recent branches of BIG-IP devices. The CFC recommends immediately patching your vulnerable version. If it does not exist, the CFC recommends upgrading to a newer branch.
Temporary workarounds and mitigations
Until it is possible to install a fixed version, F5 provided temporary mitigations which restrict access to iControl REST to only trusted networks or devices. As this decreases the attack surface drastically, the CFC recommends applying the described mitigation steps immediately, until the BIG-IP devices have been patched.
Those mitigation include restricting or blocking iControl REST access through management interface or the self IP addresses. Another possibility to mitigate the CVE consists in modifying the httpd configuration.
Please refer to the official documentation https://support.f5.com/csp/article/K23605346#proc1 for full details on how to apply mitigations.
The CFC also recommends reviewing the audit logs with the BIG-IP appliance for any suspicious activity.
What the Cyber Fusion Center is doing
While there are currently no known exploits, the CFC is currently contacting all Security Device Management (SDM) clients on F5 to organize the patching of all their impacted appliances and ensure there are no traces of exploitation of this CVE.
Kudelski Security Research 