CVE-2024-31156
📋 TL;DR
This stored XSS vulnerability in the BIG-IP Configuration utility allows attackers to inject malicious JavaScript that executes when legitimate users view the compromised page. This affects BIG-IP systems running supported software versions, potentially enabling session hijacking, credential theft, or configuration changes.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains administrative control of BIG-IP system, modifies network configurations, intercepts all traffic, or deploys persistent backdoors across the network infrastructure.
Likely Case
Attacker steals administrator session cookies, gains unauthorized access to the Configuration utility, and modifies load balancing rules or SSL/TLS settings.
If Mitigated
Attack limited to isolated administrative interface with no lateral movement due to network segmentation and strict access controls.
🎯 Exploit Status
Requires attacker to have authenticated access to Configuration utility or compromise legitimate user credentials first.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check F5 advisory K000138636 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000138636
Restart Required: Yes
Instructions:
1. Log into F5 Support site 2. Download appropriate fixed version for your BIG-IP model 3. Backup configuration 4. Install update via Configuration utility or CLI 5. Reboot system as required
🔧 Temporary Workarounds
Restrict Configuration Utility Access
allLimit access to BIG-IP Configuration utility to trusted IP addresses only
Configure firewall rules to restrict access to BIG-IP management IP/ports
Implement WAF Protection
allDeploy web application firewall with XSS protection rules
Configure ASM policy with XSS attack signatures enabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate BIG-IP management interfaces
- Enforce multi-factor authentication for all BIG-IP administrative accounts
🔍 How to Verify
Check if Vulnerable:
Check BIG-IP version against affected versions in F5 advisory K000138636Check Version:
tmsh show sys versionVerify Fix Applied:
Verify installed version matches or exceeds fixed version from F5 advisory📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript payloads in Configuration utility access logs
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unexpected connections to BIG-IP management interface from unusual IPs
- Suspicious outbound connections from BIG-IP system
SIEM Query:
source="bigip_logs" AND ("script" OR "javascript" OR "<script") AND uri="*Configuration*"