F5 BIG-IP up to 14.1.0.5 iControl REST Worker command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in F5 BIG-IP up to 11.6.4/12.1.4.1/13.1.1.4/14.0.0.5/14.1.0.5. Affected by this issue is some unknown functionality of the component iControl REST Worker. This manipulation causes command injection. This vulnerability is registered as CVE-2019-6622. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as critical was found in F5 BIG-IP up to 11.6.4/12.1.4.1/13.1.1.4/14.0.0.5/14.1.0.5 (Firewall Software). Affected by this vulnerability is an unknown functionality of the component iControl REST Worker. The manipulation with an unknown input leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to command injection by an administrator or resource administrator user. This attack is only exploitable on multi-bladed systems.

The weakness was published 07/02/2019 (Website). It is possible to read the advisory at support.f5.com. This vulnerability is known as CVE-2019-6622 since 01/22/2019. The exploitation appears to be easy. The attack can be launched remotely. The successful exploitation needs a single authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/15/2023). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-137217 and VDB-137216. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

Version

• 11.6.0
• 11.6.1
• 11.6.2
• 11.6.3
• 11.6.4
• 12.1.4.0
• 12.1.4.1
• 13.1.1.0
• 13.1.1.1
• 13.1.1.2
• 13.1.1.3
• 13.1.1.4
• 14.0.0.0
• 14.0.0.1
• 14.0.0.2
• 14.0.0.3
• 14.0.0.4
• 14.0.0.5
• 14.1.0.0
• 14.1.0.1
• 14.1.0.2
• 14.1.0.3
• 14.1.0.4
• 14.1.0.5

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion