CVE-2024-22093
📋 TL;DR
An authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on F5 multi-bladed systems running in appliance mode. This allows attackers to execute arbitrary commands and potentially cross security boundaries. Only affects F5 multi-bladed systems with specific configurations.
💻 Affected Systems
- F5 BIG-IP multi-bladed systems
📦 What is this software?
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary commands with elevated privileges, potentially gaining control over the entire appliance and connected systems.
Likely Case
Unauthorized command execution leading to data exfiltration, lateral movement within the network, or service disruption.
If Mitigated
Limited impact due to authentication requirements and specific configuration needed, but still represents significant risk if exploited.
🎯 Exploit Status
Requires authentication and specific knowledge of the undisclosed endpoint. Multi-blade configuration requirement adds complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000137522 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000137522
Restart Required: Yes
Instructions:
1. Review F5 advisory K000137522. 2. Identify affected version. 3. Upgrade to fixed version per vendor guidance. 4. Restart affected services.
🔧 Temporary Workarounds
Restrict iControl REST Access
allLimit access to iControl REST endpoints to trusted IP addresses only
Configure network ACLs to restrict access to iControl REST ports (typically 443)
Disable Appliance Mode if Not Required
allIf appliance mode is not needed for your deployment, disable it
Consult F5 documentation for disabling appliance mode specific to your configuration
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems
- Enforce strong authentication and monitor for suspicious iControl REST access patterns
🔍 How to Verify
Check if Vulnerable:
Check if system is multi-bladed and running in appliance mode. Review F5 advisory for specific version checks.Check Version:
tmsh show sys versionVerify Fix Applied:
Verify system is running a version listed as fixed in F5 advisory K000137522📡 Detection & Monitoring
Log Indicators:
- Unusual iControl REST endpoint access patterns
- Authentication attempts followed by command execution patterns
- System logs showing unexpected process execution
Network Indicators:
- Unusual traffic to iControl REST endpoints from unexpected sources
- Command and control traffic originating from F5 systems
SIEM Query:
source="f5_bigip" AND (event_type="authentication" OR event_type="command_execution") | stats count by src_ip, user