CVE-2021-23015
📋 TL;DR
This vulnerability allows authenticated BIG-IP administrators to bypass Appliance Mode security restrictions using undisclosed iControl REST endpoints. It affects BIG-IP systems running specific versions in Appliance Mode configuration. Attackers with administrator credentials could potentially perform actions that should be restricted in Appliance Mode.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
⚠️ Risk & Real-World Impact
Worst Case
An authenticated malicious administrator could bypass all Appliance Mode restrictions, potentially gaining full system control, accessing restricted data, or modifying critical configurations that should be locked down.
Likely Case
An administrator with legitimate credentials but malicious intent could bypass specific Appliance Mode restrictions to perform unauthorized actions that violate security policies.
If Mitigated
With proper access controls and monitoring, the impact is limited to authorized administrators who might bypass some restrictions but would still be subject to audit trails.
🎯 Exploit Status
Exploitation requires authenticated administrator access and knowledge of undisclosed iControl REST endpoints. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: BIG-IP 15.1.3, 14.1.4.2, 13.1.3.7, and 16.1.0
Vendor Advisory: https://support.f5.com/csp/article/K74151369
Restart Required: Yes
Instructions:
1. Download appropriate patch from F5 Downloads site. 2. Backup current configuration. 3. Apply patch following F5 upgrade procedures. 4. Reboot system as required. 5. Verify patch installation and functionality.
🔧 Temporary Workarounds
Disable Appliance Mode
allIf Appliance Mode is not required, disable it to remove the vulnerability surface.
tmsh modify sys db provision.extramb value 0
tmsh save sys config
Restrict iControl REST Access
allLimit access to iControl REST endpoints to trusted IP addresses only.
tmsh modify /sys httpd allow replace-all-with { trusted_ip_ranges }
🧯 If You Can't Patch
- Implement strict access controls and monitoring for administrator accounts
- Disable Appliance Mode if not required for your deployment
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP version with 'tmsh show sys version' and verify if running in Appliance Mode with affected versions.Check Version:
tmsh show sys versionVerify Fix Applied:
Verify installed version is patched with 'tmsh show sys version' and confirm version is 15.1.3+, 14.1.4.2+, 13.1.3.7+, or 16.1.0+.📡 Detection & Monitoring
Log Indicators:
- Unusual iControl REST endpoint access by administrators
- Configuration changes that should be restricted in Appliance Mode
- Failed attempts to access restricted endpoints
Network Indicators:
- Unusual REST API traffic patterns from administrator accounts
- Access to undocumented iControl endpoints
SIEM Query:
source="bigip" AND ("iControl" OR "REST") AND user_role="Administrator" AND action="modify"