Published: 07/12/2022 Updated: 07/11/2023

CVSS v3 Base Score: 8.7 | Impact Score: 5.8 | Exploitability Score: 2.3

VMScore: 0

In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the malicious user to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Vulnerable Product	Search on Vulmon	Subscribe to Product
f5 big-ip access policy manager 17.0.0
f5 big-ip analytics 17.0.0
f5 big-ip application security manager 17.0.0
f5 big-ip application acceleration manager 17.0.0
f5 big-ip policy enforcement manager 17.0.0
f5 big-ip local traffic manager 17.0.0
f5 big-ip link controller 17.0.0
f5 big-ip global traffic manager 17.0.0
f5 big-ip fraud protection service 17.0.0
f5 big-ip domain name system 17.0.0
f5 big-ip analytics
f5 big-ip policy enforcement manager
f5 big-ip local traffic manager
f5 big-ip link controller
f5 big-ip global traffic manager
f5 big-ip fraud protection service
f5 big-ip domain name system
f5 big-ip application security manager
f5 big-ip application acceleration manager
f5 big-ip access policy manager
f5 big-ip advanced firewall manager

This Metasploit module creates a local user with a username/password and root-level privileges Note that a root-level account is not required to do this, which makes it a privilege escalation issue Note that this is pretty noisy, since it creates a user account and creates log files and such Additionally, most (if not all) vulnerabilities in F5 ...

This Metasploit module exploits a cross-site request forgery (CSRF) vulnerability in F5 Big-IP's iControl interface to write an arbitrary file to the filesystem While any file can be written to any location as root, the exploitability is limited by SELinux; the vast majority of writable locations are unavailable By default, we write to a script t ...

This Metasploit module exploits a newline injection into an RPM rpmspec file that permits authenticated users to remotely execute commands Successful exploitation results in remote code execution as the root user ...

This module exploits a newline injection into an RPM rpmspec file that permits authenticated users to remotely execute commands Successful exploitation results in remote code execution as the root user ...

This module exploits a newline injection into an RPM .rpmspec file that permits authenticated users to remotely execute commands. Successful exploitation results in remote code execution as the root user.

msf > use exploit/linux/http/f5_icontrol_rpmspec_rce_cve_2022_41800
msf exploit(f5_icontrol_rpmspec_rce_cve_2022_41800) > show targets
    ...targets...
msf exploit(f5_icontrol_rpmspec_rce_cve_2022_41800) > set TARGET < target-id >
msf exploit(f5_icontrol_rpmspec_rce_cve_2022_41800) > show options
    ...show and set options...
msf exploit(f5_icontrol_rpmspec_rce_cve_2022_41800) > exploit

CWE-77 https://support.f5.com/csp/article/K13325942 https://nvd.nist.gov https://packetstormsecurity.com/files/170847/F5-Big-IP-Create-Administrative-User.html https://www.rapid7.com/db/modules/exploit/linux/http/f5_icontrol_rpmspec_rce_cve_2022_41800/

CVE-2022-41800

Vulnerability Summary

Vulnerability Trend

Exploits

Metasploit Modules

References

Vulmon Search

About

Products

Connect