Customers in Sensitive Fields Affected by Critical F5 BIG-IP Vulnerability

Security provider F5 has tackled more than a dozen high-severity bugs in its BIG-IP networking device, including one vulnerability that was considered as critical severity when abused under certain circumstances.

F5, Inc. is a U.S. organization that specializes in application delivery networking (ADN), application availability & performance, multi-cloud management, application security, network security, access & authorization, and online fraud prevention.

On August 24th, 2021, F5 has published a list of 35 security issues that impact multiple F5 devices of which 13 were considered high-severity vulnerabilities, 15 medium, and 7 low.

One of the 13 high-severity vulnerabilities is tracked as CVE-2021-23031 and is a privilege escalation issue on BIG-IP Advanced Web Application Firewall (WAF) and Web Application Firewall (ASM) Traffic Management User Interface (TMUI).

What Happens When the Bug Is Exploited?

When abused, the CVE-2021-23031 bug enables an authenticated threat actor who has access to the Configuration utility to carry out arbitrary system commands, generate or remove documents, or deactivate systems. This flaw could allow a hacker to completely damage a system.

According to the advisory, the vulnerability got a severity rating of 8.8, but for the Appliance Mode customers, the score increases to 9.9 out of 10. 

What Can Users Do?

It also notes that only a limited number of customers are affected by the issue in a critical mode.

Because this cyberattack is organized by authenticated users, there is no feasible mitigation that also enables users’ access to the Configuration utility. F5 states that the only way to protect against these attacks is to remove access for users who are not completely trusted.

The fixed issues include request forgery flaws, authenticated remote command execution bugs, cross-site scripting (XSS)vulnerabilities, and insufficient permission and denial-of-service flaws:

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also issued a security advisory regarding the F5 matter urging users and administrators to “review the F5 security advisory and install updated software or apply the necessary mitigations as soon as possible.”