OS Command Injection in F5 Networks products - CVE-2021-22987

Vulnerability identifier: #VU51493

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22987

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the Traffic Management User Interface (TMUI) when running in Appliance mode. A remote authenticated user with network access to the Configuration utility, through the BIG-IP management port, or self IP addresses can send specially crafted request and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

BIG-IP FPS
BIG-IP Analytics
BIG-IP GTM
BIG-IP PEM
BIG-IP APM
BIG-IP ASM
BIG-IP LTM
BIG-IP AFM
BIG-IP Advanced WAF
BIG-IP AAM
BIG-IP Link Controller
BIG-IP DNS
BIG-IP
BIG-IP SSLO
BIG-IP DDHD

Install updates from vendor's website.

BIG-IP FPS - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP Advanced WAF - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP Analytics - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP GTM - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP PEM - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP AAM - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP Link Controller - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP APM - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP ASM - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP LTM - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP SSLO - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP DDHD - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP DNS - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1
BIG-IP AFM - addressed in versions 11.6.5.3, 12.1.5.3, 13.1.3.6, 14.1.4, 15.1.2.1, 16.0.1.1

• https://support.f5.com/csp/article/K18132488

• Remote authenticated command execution in BIG-IP Appliance mode TMUI