The Confusing History of F5 BIG-IP RCE Vulnerabilities | Grey Noise Blog
Summary: GreyNoise researchers traced an untagged shell-injection exploit in their Sift data that resembled CVE-2021-22986, a well-known SSRF bug, but was a different vulnerability discussed in many of the same write-ups. The investigation found that the CVE-2021-22986 patch fixed two similar but distinct vulnerabilities, neither of them the shell injection, and that F5 BIG-IP's management port has an intended method for running Linux commands as root that the researchers used to escalate any local user to root.
Bottom line: F5 BIG-IP's management port ships with a built-in way to run commands as root, and the researchers demonstrated escalating any local user to root with it - a capability that authentication bypass flaws like CVE-2021-22986 and CVE-2022-1388 can hand to an attacker.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-22986CVE-2021-23015CVE-2022-1388CVE-2022-41800
- Related
- CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability Known Exploited Vulnerabilities · May 10, 2022