Vulnerabilities > CVE-2014-2928 - Remote Command Injection vulnerability in Multiple F5 BIG-IP Products

047910
CVSS 7.1 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
SINGLE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
high complexity
f5
nessus
exploit available
metasploit
NVD
Published: 2014-05-12
Updated: 2015-11-20

Summary

The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, Enterprise Manager 2.1.0 through 2.3.0 and 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request. Per: http://cwe.mitre.org/data/definitions/77.html "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"

Vulnerable Configurations

Part Description Count
Application
F5
86

Exploit-Db

descriptionF5 iControl Remote Root Command Execution. CVE-2014-2928. Remote exploit for unix platform
fileexploits/unix/remote/34927.rb
idEDB-ID:34927
last seen2016-02-04
modified2014-10-09
platformunix
port443
published2014-10-09
reportermetasploit
sourcehttps://www.exploit-db.com/download/34927/
titleF5 iControl Remote Root Command Execution
typeremote

Metasploit

descriptionThis module exploits an authenticated remote command execution vulnerability in the F5 BIGIP iControl API (and likely other F5 devices).
idMSF:EXPLOIT/LINUX/HTTP/F5_ICONTROL_EXEC
last seen2020-06-07
modified2017-07-24
published2014-09-27
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/f5_icontrol_exec.rb
titleF5 iControl Remote Root Command Execution

Nessus

NASL familyF5 Networks Local Security Checks
NASL idF5_BIGIP_SOL15220.NASL
descriptionThe iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator, WOM 11.0.0 through 11.3.0, Enterprise Manager 3.0.0 through 3.1.1, and BIG-IQ Cloud, Device, and Security 4.0.0 through 4.3.0 allows remote administrators to execute arbitrary commands via shell metacharacters in the hostname element in a SOAP request. (CVE-2014-2928) Impact Users may be able to run arbitrary commands on a BIG-IP system using an authenticated iControl connection.
last seen2020-06-01
modified2020-06-02
plugin id78166
published2014-10-10
reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/78166
titleF5 Networks BIG-IP : iControl vulnerability (K15220)

Packetstorm

References