CVE-2022-23013
📋 TL;DR
This DOM-based cross-site scripting (XSS) vulnerability in BIG-IP DNS & GTM Configuration utility allows attackers to execute malicious JavaScript in the context of a logged-in administrator. Affected users include organizations running vulnerable BIG-IP DNS/GTM versions 11.6.x through 16.x, with the highest risk to those with internet-facing management interfaces.
💻 Affected Systems
- F5 BIG-IP DNS
- F5 BIG-IP GTM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of BIG-IP system leading to credential theft, configuration modification, lateral movement to internal networks, and potential data exfiltration.
Likely Case
Session hijacking, credential theft, and unauthorized configuration changes to DNS/GTM settings.
If Mitigated
Limited impact due to network segmentation, strong access controls, and proper authentication mechanisms.
🎯 Exploit Status
Requires attacker to lure authenticated user to malicious page. DOM-based XSS typically requires user interaction but can be automated via phishing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.1.0, 15.1.4, 14.1.4.4
Vendor Advisory: https://support.f5.com/csp/article/K29500533
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download appropriate patch from F5 Downloads. 3. Upload and install via Configuration utility or CLI. 4. Reboot system as required. 5. Verify patch installation.
🔧 Temporary Workarounds
Restrict Configuration Utility Access
allLimit access to Configuration utility to trusted IP addresses only
Configure firewall rules to restrict access to BIG-IP management IP/ports
Enable Content Security Policy
allImplement CSP headers to mitigate XSS impact
Add Content-Security-Policy headers via iRules or web server configuration
🧯 If You Can't Patch
- Isolate BIG-IP management interface to separate VLAN with strict access controls
- Implement multi-factor authentication for all administrative accounts
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP version via Configuration utility (System > Platform) or CLI commandCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify installed version matches patched versions: 16.1.0+, 15.1.4+, or 14.1.4.4+📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution in Configuration utility logs
- Multiple failed login attempts followed by successful login from unusual location
Network Indicators:
- Unexpected outbound connections from BIG-IP management interface
- Suspicious HTTP requests to Configuration utility with script tags
SIEM Query:
source="bigip_audit.log" AND ("script" OR "javascript" OR "onload=" OR "onerror=")