CVE-2023-28742
📋 TL;DR
CVE-2023-28742 is an authenticated remote command execution vulnerability in F5 BIG-IP DNS iQuery mesh functionality. An authenticated attacker with network access to the iQuery mesh can execute arbitrary system commands. This affects BIG-IP DNS configurations using iQuery mesh for DNS synchronization.
💻 Affected Systems
- F5 BIG-IP DNS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary commands as root, potentially leading to data theft, service disruption, or lateral movement within the network.
Likely Case
Privileged attacker gains command execution on DNS servers, potentially modifying DNS records, intercepting traffic, or establishing persistence.
If Mitigated
Limited impact due to network segmentation, strict access controls, and monitoring preventing successful exploitation.
🎯 Exploit Status
Requires authenticated access to iQuery mesh (typically TCP port 4353). No public exploit code available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: BIG-IP 17.x: 17.1.0.1+, BIG-IP 16.x: 16.1.4.1+, BIG-IP 15.x: 15.1.10.1+, BIG-IP 14.x: 14.1.5.1+
Vendor Advisory: https://my.f5.com/manage/s/article/K000132972
Restart Required: Yes
Instructions:
1. Download appropriate hotfix from F5 Downloads. 2. Upload to BIG-IP system. 3. Install hotfix via GUI or CLI. 4. Reboot system as required.
🔧 Temporary Workarounds
Restrict iQuery Mesh Access
linuxLimit network access to iQuery mesh port (TCP 4353) to only trusted BIG-IP DNS peers using firewall rules.
# Example iptables rule: iptables -A INPUT -p tcp --dport 4353 -s <trusted_ip> -j ACCEPT
# Example iptables rule: iptables -A INPUT -p tcp --dport 4353 -j DROP
Disable iQuery Mesh
allTemporarily disable iQuery mesh if not required for DNS synchronization.
# Via GUI: DNS > GSLB > Mesh > Disable
# Via CLI: tmsh modify gtm global-settings general { iquery-enabled no }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate iQuery mesh traffic to only necessary BIG-IP DNS peers.
- Enhance monitoring and alerting for unusual commands or connections on iQuery mesh port 4353.
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP version and confirm DNS is provisioned with iQuery mesh enabled: tmsh show sys version; tmsh list gtm global-settings general | grep iquery-enabledCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify installed hotfix version matches patched versions: tmsh show sys software hotfix; confirm iquery-enabled setting if workaround applied.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in /var/log/ltm
- Authentication failures or unusual connections on port 4353 in /var/log/secure
Network Indicators:
- Unexpected connections to TCP port 4353 from unauthorized sources
- Unusual DNS synchronization traffic patterns
SIEM Query:
source="*/var/log/ltm*" AND "command execution" OR dest_port=4353 AND NOT src_ip IN (trusted_peer_ips)