F5 BIG-IP/BIG-IQ iControl REST server-side request forgery

Summaryinfo

A vulnerability, which was classified as very critical, was found in F5 BIG-IP and BIG-IQ. This impacts an unknown function of the component iControl REST. The manipulation results in an unknown weakness. This vulnerability is known as CVE-2021-22986. It is possible to launch the attack remotely. Furthermore, an exploit is available.

Detailsinfo

A vulnerability classified as very critical has been found in F5 BIG-IP and BIG-IQ (Firewall Software) (affected version not known). Affected is some unknown functionality of the component iControl REST. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

The weakness was published 03/10/2021 as K02566623. The advisory is shared for download at support.f5.com. This vulnerability is traded as CVE-2021-22986. Technical details are unknown but a public exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/30/2025).

The exploit is shared for download at exploit-db.com. It is declared as attacked. As 0-day the estimated underground price was around $25k-$100k. This issue was added on 11/03/2021 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 11/17/2021:

Apply updates per vendor instructions.

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (49738). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP
• BIG-IQ

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion