F5 BIG-IP iControl REST Authentication Bypass RCE
- Product
- F5 BIG-IP iControl REST
- CVE
- CVE-2022-1388
- Disclosed
- 2022-05-04
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- BIG-IP 16.1.0-16.1.2, 15.1.0-15.1.5, 14.1.0-14.1.4, 13.1.0-13.1.4, 12.1.x, 11.6.x.
- Fixed
- 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 (12.x/11.x not fixed).
Summary
An authentication bypass in BIG-IP's iControl REST API allowed unauthenticated attackers to run arbitrary system commands. Public PoCs appeared within days and mass exploitation, including destructive wiping, followed.
Root cause
Apache forwards requests to the Jetty-based iControl REST service and relies on an auth-token header being present. Listing that header as a hop-by-hop header in the Connection header causes Apache to strip it before forwarding, and the backend then falls back to trusting the request as coming from localhost.
Impact
Unauthenticated root command execution on the appliance.
Detection
Look for requests to /mgmt/tm/util/bash and Connection headers listing X-F5-Auth-Token. Nuclei template CVE-2022-1388.
Mitigation
Upgrade; restrict management interface access or block the iControl REST path through self-IPs.