CVE-2022-1388: What is Authentication Bypass in F5 BIG-IP?
As part of the May 2022 Quarterly Security Bulletin, F5 patched CVE-2022-1388; this is a critical authentication bypass vulnerability in the BIG-IP family, used for application delivery and central device management.
Attackers had exploited previously disclosed BIG-IP vulnerabilities: CVE-2021-22986, a flaw in the iControl REST component of BIG-IP, and CVE-2020-5902, a vulnerability in the BIG-IP traffic management user interface. Both had fallen victim to attacks. The Security Response Team included CVE-2020-5902 among the top 5 vulnerabilities due to the attack scope used in the 2020 Threat Landscape Retrospective. Shortly after the initial evidence was published, on May 9th, attack attempts were detected in the wild.
What is CVE-2022-1388?
CVE-2022-1388 is an authentication bypass vulnerability in the iControl API's REST component of BIG-IP, assigned a CVSSv3 score of 9.8. The iControl REST API is used for the management and configuration of BIG-IP devices. CVE-2022-1388 can be exploited by an unauthenticated attacker with network access to the management port or self-assigned IP addresses of devices using BIG-IP. The attack allows the adversary to execute arbitrary system commands, create and delete files, and disable services.
Solution
To mitigate the attack surface, organizations can restrict sensitive iControl REST API access to trusted networks and devices. It is recommended to block access from untrusted networks to device management interfaces.
The table below includes affected BIG-IP versions and the patched versions:
| Branch | Affected Versions | Fixed Version |
|---|---|---|
| 17.x | None | 17.0.0 |
| 16.x | 16.1.0 - 16.1.2 | 16.1.2.2 |
| 15.x | 15.1.0 - 15.1.5 | 15.1.5.1 |
| 14.x | 14.1.0 - 14.1.4 | 14.1.4.6 |
| 13.x | 13.1.0 - 13.1.4 | 13.1.5 |
| 12.x | 12.1.0 - 12.1.6 | Will not fix |
| 11.x | 11.6.1 - 11.6.5 | Will not fix |
To identify this vulnerability, you can access a list of Tenable plugins here. To check for the Httpd vulnerability, a compliance check file is available here. Additionally, a remote check plugin has been released to determine if your F5 BIG-IP deployments are vulnerable to CVE-2022-1388.
Click on these links:
F5 Advisory for CVE-2022-5902
K55879220: Overview of F5 vulnerabilities (May 2022)
Source : https://www.turkhackteam.org/konula...ipte-kimlik-dogrulama-atlatma-bypass.2048858/
