CVE-2021-22978
📋 TL;DR
This vulnerability is a reflected cross-site scripting (XSS) attack in the iControl REST interface of F5 BIG-IP devices. Attackers can craft malicious URLs that execute JavaScript in the browser of authenticated users, potentially leading to full system compromise if the victim has admin privileges. Affected versions include BIG-IP 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of BIG-IP system with administrative access, allowing attacker to steal credentials, modify configurations, intercept traffic, or deploy malware.
Likely Case
Session hijacking, credential theft, or unauthorized configuration changes by tricking authenticated users into clicking malicious links.
If Mitigated
Limited impact if proper access controls, network segmentation, and user awareness training are implemented.
🎯 Exploit Status
Requires social engineering to trick authenticated users into clicking malicious links. Attack is reflected through vulnerable iControl REST endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.0.1, 15.1.1, 14.1.3.1, 13.1.3.5
Vendor Advisory: https://support.f5.com/csp/article/K87502622
Restart Required: Yes
Instructions:
1. Download appropriate patch from F5 Downloads site. 2. Backup current configuration. 3. Apply patch using F5 upgrade procedures. 4. Restart system. 5. Verify version after restart.
🔧 Temporary Workarounds
Restrict iControl REST Access
allLimit access to iControl REST interface to trusted networks only using firewall rules or BIG-IP access policies.
tmsh modify /sys httpd allow replace-all-with { trusted_networks }
Implement Content Security Policy
allAdd Content Security Policy headers to mitigate XSS impact.
tmsh modify /sys httpd include "Content-Security-Policy: default-src 'self'"
🧯 If You Can't Patch
- Implement strict network segmentation to isolate BIG-IP management interfaces
- Enforce strong authentication and session management controls
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP version using 'tmsh show sys version' and compare against affected versions list.Check Version:
tmsh show sys version | grep VersionVerify Fix Applied:
Verify version is 16.0.1 or higher, 15.1.1 or higher, 14.1.3.1 or higher, or 13.1.3.5 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual iControl REST endpoint access patterns
- Suspicious URL parameters in HTTP logs
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- Malicious JavaScript payloads in HTTP requests to iControl REST endpoints
- Unusual outbound connections from BIG-IP management interface
SIEM Query:
source="bigip_logs" AND (url="*iControl*" AND (param="*<script>*" OR param="*javascript:*"))