Security News > 2021 > March > Now it is F5’s turn to reveal critical security bugs – and the Feds were quick to sound the alarm on these BIG-IP flaws

To kick off, there's CVE-2021-22987, which scores a 9.9 on the ten-point CVSS scale of severity as it "Allows authenticated users with network access to the Configuration utility, through the BIG-IP management port, or self IP addresses, to execute arbitrary system commands, create or delete files, or disable services." Administrators are advised the flaw allows "Complete system compromise and breakout of Appliance mode." Note that this can only be exploited via the control plane, and it does require an attacker to have a valid login - so a rogue insider or someone using stolen credentials, perhaps.

At a mere 9.8 rating, CVE-2021-22986 "Allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services." Complete system compromise is again a possible consequence.

F5 says: "A malicious HTTP response to an Advanced WAF/ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution, leading to complete system compromise." Google's Wilhelm has a proof-of-concept exploit and more info here.

CVE-2021-22989 throttles back the horror with its 8.0 rating, but it allows "Highly privileged authenticated users to execute arbitrary system commands, create or delete files, or disable services." Complete system compromise and breakout of Appliance mode are again possible.

The seven main bugs are bad enough that America's Cyberspace and Infrastructure Agency issued an advisory in which it "Encourages users and administrators review the F5 advisory and install updated software as soon as possible." That's perhaps because foreign miscreants have exploited F5 holes in the past to sneak into networks belonging to Uncle Sam and big business.

The dossier says observed attacks exploiting the Exchange flaws are "Consistent with previous targeting activity by Chinese cyber actors."

News URL

https://go.theregister.com/feed/www.theregister.com/2021/03/11/f5_critical_flaws/