CVE-2022-1388 PoC — F5 BIG-IP 访问控制错误漏洞

Source

https://github.com/li8u99/CVE-2022-1388

Associated Vulnerability

Title:F5 BIG-IP 访问控制错误漏洞 (CVE-2022-1388)
Description:On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Description

CVE-2022-1388 | F5 - Big IP Pre Auth RCE via '/mgmt/tm/util/bash' endpoint

Readme

# F5-CVE-2022-1388-Exploit
Exploit and Check Script for CVE 2022-1388


## Usage
```
bash
     _____  _   _  _____        _____  _____  _____  _____        __   _____  _____  _____ 
    /  __ \| | | ||  ___|      / __  \|  _  |/ __  \/ __  \      /  | |____ ||  _  ||  _  |
    | /  \/| | | || |__  ______`' / /'| |/' |`' / /'`' / /'______`| |     / / \ V /  \ V / 
    | |    | | | ||  __||______| / /  |  /| |  / /    / / |______|| |     \ \ / _ \  / _ \ 
    | \__/\ \_/ /| |___       ./ /___\ |_/ /./ /___./ /___      _| |_.___/ /| |_| || |_| |
     \____/ \___/ \____/       \_____/ \___/ \_____/\_____/      \___/\____/ \_____ \_____/                                         
                                                      
    

    CVE-2022-1388 F5 Exploit [ Valentin Lobstein ]
    Usage:
            Exploit Host: python3 CVE_2022_1388.py -u target_url -c command 
            Exploit List: python3 CVE_2022_1388.py -f file -c command
            ( Command is not required )

```

### Detection:

Scanning for `/mgmt/tm/util/bash` as an endpoint, likely to be in web server logs. Or if you have a F5 go patch it, the affected versions are shown below and the patch is available here https://support.f5.com/csp/article/K23605346


### Zoomeye Dork:
```

zoomeye search 'banner:"BIG-IP Configuration Utility"'  -num 1000  -filter=ip,port
zoomeye search 'title:"BIG-IP&reg;-+Redirect"+"Server"'  -num 10  -filter=ip,port


```

### Shodan Dork:
```

shodan  search 'http.html:"BIG-IP Configuration Utility"' --fields=ip_str,port --separator ":" --limit 10 | grep ''
shodan  search 'http.title:"BIG-IP&reg;-+Redirect"+"Server"' --fields=ip_str,port --separator ":" --limit 10 | grep ''

```



### Vulnerable Versions
- BIG-IP versions 16.1.0 to 16.1.2 (Patch released)
- BIG-IP versions 15.1.0 to 15.1.5 (Patch released)
- BIG-IP versions 14.1.0 to 14.1.4 (Patch released)
- BIG-IP versions 13.1.0 to 13.1.4 (Patch released)
- BIG-IP versions 12.1.0 to 12.1.6 (End of Support)
- BIG-IP versions 11.6.1 to 11.6.5 (End of Support)

File Snapshot


 [4.0K]  /data/pocs/3b60118d2e4ee2e448dd7caacef1ff948f97d86f
├── [3.9K]  CVE_2022_1388.py
├── [ 448]  parser_zoomeye.py
└── [2.0K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!