CVE-2023-38418
📋 TL;DR
The BIG-IP Edge Client Installer on macOS has improper privilege elevation during installation, allowing local attackers to potentially gain elevated privileges. This affects macOS users installing the BIG-IP Edge Client. Only versions still under technical support are evaluated.
💻 Affected Systems
- F5 BIG-IP Edge Client
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root privileges on macOS system through installer exploitation
Likely Case
Privilege escalation during installation allowing unauthorized system access
If Mitigated
Minimal impact with proper installation controls and monitoring
🎯 Exploit Status
Requires local access to macOS system during installation process
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000134746 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000134746
Restart Required: No
Instructions:
1. Review F5 advisory K000134746
2. Download updated BIG-IP Edge Client installer
3. Uninstall previous version
4. Install updated version following standard macOS installation procedures
🔧 Temporary Workarounds
Restrict installation privileges
macOSLimit who can install software on macOS systems
sudo /usr/sbin/dseditgroup -o edit -a username -t user admin
🧯 If You Can't Patch
- Restrict BIG-IP Edge Client installation to trusted administrators only
- Monitor installation logs and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP Edge Client version and compare against F5 advisory K000134746Check Version:
Check application version in macOS About dialog or via package managerVerify Fix Applied:
Verify installed version matches or exceeds fixed version in advisory📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation during installation
- Installation process running with elevated privileges
Network Indicators:
- Local installation activity
SIEM Query:
macOS installation logs showing BIG-IP Edge Client privilege escalation