CVE-2022-1388 is a critical remote code execution vulnerability in the iControlREST component of F5 BIG-IP products. Disclosed on May 4, 2022, this vulnerability allows threat actors to bypass authentication and execute arbitrary code on unpatched systems. The vulnerability has a CVSS score of 9.8, indicating its high severity. Attackers can exploit this flaw to gain complete control over the affected systems, enabling them to manipulate critical services and data.
The vulnerability exists within the iControl REST framework used by BIG-IP. An unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses can exploit this vulnerability to execute arbitrary system commands, create or delete files, or disable services. This makes the vulnerability extremely dangerous, especially for organizations that expose the BIG-IP management interface to the internet.
Since the disclosure, there has been mass scanning activity and active exploitation attempts. Proof-of-concept (PoC) exploits have been developed and attacks leveraging the vulnerability have been observed in the wild. The vulnerability can also be exploited by someone who has access to the targeted organization’s network, making internal systems equally vulnerable.
F5 has released patches to mitigate this vulnerability, and organizations are strongly advised to update their BIG-IP deployments to the latest versions. Until patches can be applied, it is recommended to block iControl REST access through the self IP address to mitigate the risk. Additionally, Palo Alto Networks has released a Threat Prevention signature (92570) to help protect against this vulnerability.
| 