CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability

What it is

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Exploitation evidence

First exploit evidence seen: 2022-05-04 (earliest date across the sources below).

Exploited in the wild

• CISA KEV: listed since 2022-05-10. Source

Public exploit code

Metasploit

• exploit/linux/http/f5_icontrol_rce: F5 BIG-IP iControl RCE via REST Authentication Bypass (disclosure 2022-05-04)

Exploit-DB

• EDB-50932: F5 BIG-IP 16.0.x - Remote Code Execution (RCE) (2022-05-12)

GitHub proof-of-concept repositories

64 public repositories from 62 accounts, first seen 2022-05-05. Most starred: horizon3ai/CVE-2022-1388 (230 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · Rapid7 Metasploit Framework module metadata · Exploit-DB (OffSec) · nomi-sec/PoC-in-GitHub.

How to fix it

CISA required action

Apply updates per vendor instructions. (source: CISA KEV)

Fixed versions

• f5 big-ip access policy manager: upgrade to 13.1.5 or later (affected from 13.1.0)
• f5 big-ip access policy manager: upgrade to 14.1.4.6 or later (affected from 14.1.0)
• f5 big-ip access policy manager: upgrade to 15.1.5.1 or later (affected from 15.1.0)
• f5 big-ip access policy manager: upgrade to 16.1.2.2 or later (affected from 16.1.0)
• f5 big-ip advanced firewall manager: upgrade to 13.1.5 or later (affected from 13.1.0)
• f5 big-ip advanced firewall manager: upgrade to 14.1.4.6 or later (affected from 14.1.0)
• f5 big-ip advanced firewall manager: upgrade to 15.1.5.1 or later (affected from 15.1.0)
• f5 big-ip advanced firewall manager: upgrade to 16.1.2.2 or later (affected from 16.1.0)
• f5 big-ip analytics: upgrade to 13.1.5 or later (affected from 13.1.0)
• f5 big-ip analytics: upgrade to 14.1.4.6 or later (affected from 14.1.0)
• f5 big-ip analytics: upgrade to 15.1.5.1 or later (affected from 15.1.0)
• f5 big-ip analytics: upgrade to 16.1.2.2 or later (affected from 16.1.0)
• f5 big-ip application acceleration manager: upgrade to 13.1.5 or later (affected from 13.1.0)
• f5 big-ip application acceleration manager: upgrade to 14.1.4.6 or later (affected from 14.1.0)
• f5 big-ip application acceleration manager: upgrade to 15.1.5.1 or later (affected from 15.1.0)
• f5 big-ip application acceleration manager: upgrade to 16.1.2.2 or later (affected from 16.1.0)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

• https://support.f5.com/csp/article/K23605346 (Mitigation, Vendor Advisory)
• https://www.secpod.com/blog/critical-f5-big-ip-remote-code-execution-vulnerability-patch-now/ (Exploit, Mitigation, Third Party Advisory)

MITRE ATT&CK mitigations for this chain

• M1038 Execution Prevention (for T1548) : System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.
• M1028 Operating System Configuration (for T1548) : Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is
• M1051 Update Software (for T1548) : Perform regular software updates to mitigate exploitation risk.
• M1052 User Account Control (for T1548) : Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as [DLL](https://attack.mitre.org/techniques/T1574/001).
• M1026 Privileged Account Management (for T1548) : Remove users from the local administrator group on systems. By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.
• M1018 User Account Management (for T1548) : Limit the privileges of cloud accounts to assume, create, or impersonate additional roles, policies, and permissions to only those required. Where just-in-time access is enabled, consider requiring manual approval for temporary elevation of privileges.
• M1047 Audit (for T1548) : Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.
• M1022 Restrict File and Directory Permissions (for T1548) : The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.

Detection Generic guidance

• Privilege Escalation: Alert on processes gaining SYSTEM/root unexpectedly, and on exploitation crashes of privileged services.

Response checklist Generic guidance

1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.