{"id":46559,"date":"2022-05-09T23:35:28","date_gmt":"2022-05-09T23:35:28","guid":{"rendered":"https:\/\/www.darkreading.com\/dr-tech\/how-to-check-if-your-f5-big-ip-device-is-vulnerable"},"modified":"2022-05-09T23:35:28","modified_gmt":"2022-05-09T23:35:28","slug":"how-to-check-if-your-f5-big-ip-device-is-vulnerable","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-to-check-if-your-f5-big-ip-device-is-vulnerable\/","title":{"rendered":"How to Check if Your F5 BIG-IP Device Is Vulnerable"},"content":{"rendered":"
<\/div>\n

Heads up for network administrators with F5\u2019s BIG-IP family of networking devices in their environment: There is a new security update available for the newly disclosed critical remote code execution vulnerability<\/a> (CVE-2022-1388). Several security researchers have already created working exploits, so administrators need to move quickly and secure their networks before the attackers come knocking.<\/p>\n

According to security researcher Kevin Beaumont, attackers are already trying to exploit the flaw<\/a> and and dropping webshells<\/a>. The vulnerability is “trivial” to exploit, Horizon3 said on Twitter<\/a>. Horizon3 is among the several groups that have already developed a working exploit.<\/p>\n

The critical flaw (with a score of 9.8 under the Common Vulnerability Scoring System) affects the BIG-IP iControl REST authentication component, F5 said on May 4. If exploited, remote adversaries can bypass authentication and execute commands with elevated privileges. They could target this vulnerability to gain initial access to the network and move laterally to access other devices on the network.<\/p>\n

Considering that BIG-IP devices are widely used in enterprise environments and serve the role of a load balancer, application firewall, and full proxy, this flaw potentially opens enterprise networks to a variety of attacks. Adversaries would be able to steal corporate data, install cryptominers, download and install malware and backdoors, or even disrupt normal business operations by launching a ransomware attack.<\/p>\n

Assessment: Is Your Organization Impacted?<\/strong>
BIG-IP is used by 48 of the Fortune 50, F5 says, and there are more than 16,000 instances of BIG-IP discoverable by Shodan. However, the vulnerability affects the management interface, so the vulnerable devices are the ones where the management interface is exposed to the Internet. According to Rapid7 lead security researcher Jacob Baines, that puts the number of affected BIG-IP devices closer to 2,500<\/a>.<\/p>\n

Administrators can execute the following one-line bash command from Randori<\/a> to determine if their instance of BIG-IP is exploitable (replace the ADDRESS with the host IP in order to execute the command): <\/p>\n

HOST=ADDRESS; if curl -s https:\/\/$HOST\/mgmt\/tm \\\n--insecure \\\n-H \"Authorization: Basic YWRtaW46\" \\\n-H \"X-F5-Auth-Token: 1\" \\\n-H \"Connection: X-Forwarded-Host, X-F5-Auth-Token\" \\\n-H \"Content-Length: 0\" | grep -q \"\\\"items\\\":\\[\"; then printf \"\\n[*] $HOST is vulnerable\\n\"; else printf \"\\n[*] $HOST doesn't appear vulnerable\\n\"; fi<\/pre>\n
The command’s output would be either a [*] 192.168.255.2<\/em> (for example) is vulnerable<\/em> or [*] 192.168.255.2 doesn’t appear vulnerable<\/em> message.<\/p>\n
Apply the Security Update<\/strong>
F5 has released security updates for BIG-IP<\/a> for the following firmware versions:<\/p>\n