PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2022-1388] Chiến dịch khai thác lỗ hổng thực thi mã từ xa trên các hệ thống sử dụng F5 BIG-IP - Phần II

blog.viettelcybersecurity.com | research | CVE-2022-1388 | #rce | #threat-intelligence | #cve-2022-1388 | #f5 | #big-ip | #webshell | #vietnam
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part two documents in-the-wild CVE-2022-1388 exploitation on F5 BIG-IP in Vietnam: attackers scan exposed interfaces, POST to /mgmt/tm/util/bash for RCE, then plant webshells from May 7, 2022.
CVE
CVE-2022-1388
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
Cảnh báo chiến dịch khai thác lỗ hổng CVE-2022-1388 trên các hệ thống sử dụng F5 BIG-IP - Phần I
Part one explains CVE-2022-1388: an auth bypass in F5 BIG-IP iControl REST (CVSS 9.8) enabling unauthenticated RCE, dissecting how Apache forwards /mgmt requests to Jetty and token validation fails.
vulnerability · bishopfox.com
CVE-2022-1388: Scan BIG-IP for Exact Release Versions
Bishop Fox released a scanner that fingerprints exact F5 BIG-IP software versions from HTTP responses, helping defenders quickly assess exposure to CVE-2022-1388, a critical auth-bypass RCE.
vulnerability · horizon3.ai
[CVE-2022-1388] F5 iControl REST Endpoint Authentication Bypass Technical Deep Dive
F5 recently patched a critical vulnerability in their BIG-IP iControl REST endpoint CVE-2022-1388. It is simple to exploit and provides an attacker with a method to execute arbitrary system commands.
research · volexity.com
OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society
In May 2017, Volexity identified and started tracking a very sophisticated and extremely widespread mass digital surveillance and attack campaign targeting several Asian nations, the ASEAN organization, and hundreds of […]
blog · bishopfox.com
Emerging Threat Notification: F5 Networks Vulnerabilities for BIG-IP and BIG-IQ Products
F5 released fixes for seven BIG-IP and BIG-IQ vulnerabilities, headlined by critical unauthenticated RCE CVE-2021-22986 in iControl REST, found by Google's Project Zero; a PoC is public.
vulnerability · swarm.ptsecurity.com
Remote Code Execution in F5 Big‑IP
Mikhail Klyuchnikov recounts discovering CVE-2020-5902, an unauthenticated RCE rated CVSS 10 in F5 Big-IP's TMUI web interface, with over 8,000 devices exposed on the internet before fixes.
Back