PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Cảnh báo chiến dịch khai thác lỗ hổng CVE-2022-1388 trên các hệ thống sử dụng F5 BIG-IP - Phần I

blog.viettelcybersecurity.com | vulnerability | CVE-2022-1388 | #rce | #authentication-bypass | #vulnerability-analysis | #cve-2022-1388 | #f5 | #big-ip
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part one explains CVE-2022-1388: an auth bypass in F5 BIG-IP iControl REST (CVSS 9.8) enabling unauthenticated RCE, dissecting how Apache forwards /mgmt requests to Jetty and token validation fails.
CVE
CVE-2022-1388
Published
Collected

Related coverage

vulnerability · bishopfox.com
CVE-2022-1388: Scan BIG-IP for Exact Release Versions
Bishop Fox released a scanner that fingerprints exact F5 BIG-IP software versions from HTTP responses, helping defenders quickly assess exposure to CVE-2022-1388, a critical auth-bypass RCE.
research · blog.viettelcybersecurity.com
Chiến dịch khai thác lỗ hổng thực thi mã từ xa trên các hệ thống sử dụng F5 BIG-IP - Phần II
Part two documents in-the-wild CVE-2022-1388 exploitation on F5 BIG-IP in Vietnam: attackers scan exposed interfaces, POST to /mgmt/tm/util/bash for RCE, then plant webshells from May 7, 2022.
vulnerability · horizon3.ai
[CVE-2022-1388] F5 iControl REST Endpoint Authentication Bypass Technical Deep Dive
F5 recently patched a critical vulnerability in their BIG-IP iControl REST endpoint CVE-2022-1388. It is simple to exploit and provides an attacker with a method to execute arbitrary system commands.
vulnerability · blog.viettelcybersecurity.com
CVE-2022-1040 Sophos XG Firewall Authentication bypass
Analysis of Sophos XG Firewall CVE-2022-1040: mapping its Apache-Jetty-CSC-Perl architecture and the patch, whose JSON filter strips non-printable characters, exposing the parsing flaw.
vulnerability · blog.viettelcybersecurity.com
CVE-2022-0540 - Authentication bypass in Seraph
The author dissects CVE-2022-0540, the Jira auth bypass in Atlassian Seraph: role resolution derives from the request URI, and one semicolon defeats the mapping, exposing privileged actions.
vulnerability · swarm.ptsecurity.com
Remote Code Execution in F5 Big‑IP
Mikhail Klyuchnikov recounts discovering CVE-2020-5902, an unauthenticated RCE rated CVSS 10 in F5 Big-IP's TMUI web interface, with over 8,000 devices exposed on the internet before fixes.
Back