CVE-2021-22987: F5 BIG-IP Access Policy Manager RCE Flaw

CVE-2021-22987 Overview

CVE-2021-22987 is an authenticated remote command execution vulnerability affecting F5 BIG-IP devices running in Appliance mode. The vulnerability exists in the Traffic Management User Interface (TMUI), also known as the Configuration utility, which allows authenticated attackers to execute arbitrary commands on the underlying system through undisclosed pages. This vulnerability is particularly dangerous because it affects BIG-IP systems operating in Appliance mode, which is designed to provide enhanced security through locked-down configurations.

The vulnerability affects a wide range of BIG-IP versions across multiple product lines, spanning versions 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x. Organizations using these affected versions in Appliance mode should prioritize remediation as the vulnerability enables complete system compromise by authenticated users.

Critical Impact

Authenticated attackers can execute arbitrary commands on F5 BIG-IP systems running in Appliance mode, potentially leading to complete infrastructure compromise, data exfiltration, and lateral movement across the network.

Affected Products

• F5 BIG-IP Access Policy Manager (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Advanced Firewall Manager (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Advanced Web Application Firewall (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Analytics (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Application Acceleration Manager (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Application Security Manager (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP DDoS Hybrid Defender (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Domain Name System (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Local Traffic Manager (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 SSL Orchestrator (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)

Discovery Timeline

• March 31, 2021 - CVE-2021-22987 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-22987

Vulnerability Analysis

This authenticated remote command execution vulnerability resides in the TMUI (Traffic Management User Interface) of F5 BIG-IP devices configured in Appliance mode. The vulnerability allows authenticated users with access to the Configuration utility to execute arbitrary system commands through specific undisclosed pages within the management interface.

BIG-IP Appliance mode is a security feature that restricts administrative access and hardens the system against unauthorized modifications. However, this vulnerability bypasses those protections, allowing command execution at the operating system level. The changed scope indicator in the vulnerability assessment means that a successful exploit can affect resources beyond the vulnerable component itself, potentially compromising the entire BIG-IP system and any services it manages.

The attack requires network access to the management interface and valid authentication credentials. Once authenticated, an attacker can leverage specific pages within TMUI to inject and execute commands with elevated privileges on the underlying system.

Root Cause

The root cause stems from insufficient input validation and improper neutralization of user-supplied data in undisclosed pages of the TMUI Configuration utility. When BIG-IP operates in Appliance mode, certain administrative functions process user input without adequate sanitization, allowing authenticated users to inject operating system commands that are subsequently executed by the system.

The vulnerability indicates a failure to properly separate user-controlled data from command execution contexts within the web-based management interface. This architectural weakness allows authenticated users to break out of the intended administrative boundaries and execute arbitrary commands on the underlying operating system.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access to the TMUI management interface. The exploitation flow involves:

1. An attacker obtains valid credentials for the BIG-IP TMUI (through credential theft, phishing, or legitimate access)
2. The attacker authenticates to the Configuration utility on a BIG-IP system running in Appliance mode
3. The attacker navigates to specific undisclosed pages within TMUI
4. Crafted input is submitted to these pages, containing embedded operating system commands
5. The commands execute on the underlying BIG-IP system with elevated privileges
6. The attacker gains control over the BIG-IP device and potentially the traffic it manages

The vulnerability is particularly dangerous in scenarios where Appliance mode was deployed specifically to prevent this type of administrative escape, giving organizations a false sense of security.

Detection Methods for CVE-2021-22987

Indicators of Compromise

• Unexpected or unauthorized command execution processes spawned by TMUI or httpd services on BIG-IP systems
• Anomalous network connections originating from BIG-IP management interfaces to external or unusual internal destinations
• Suspicious entries in /var/log/ltm, /var/log/audit, or /var/log/restjavad.0.log showing unusual API calls or administrative actions
• Creation of unauthorized user accounts or modification of existing account privileges on BIG-IP systems
• Evidence of data exfiltration or lateral movement attempts from BIG-IP infrastructure

Detection Strategies

• Monitor BIG-IP system logs for unusual command execution patterns or shell invocations associated with web server processes
• Implement network traffic analysis for management interface connections, looking for anomalous session behavior or data transfers
• Deploy file integrity monitoring on critical BIG-IP configuration files and system binaries to detect unauthorized modifications
• Correlate authentication logs with subsequent administrative actions to identify unusual activity patterns from authenticated sessions

Monitoring Recommendations

• Enable detailed logging for TMUI access and audit all Configuration utility interactions on BIG-IP systems in Appliance mode
• Configure SIEM integration to alert on command execution by web service accounts or unexpected process lineages
• Establish baseline behavior for administrative access patterns and alert on deviations, particularly for Appliance mode systems
• Implement network segmentation monitoring to detect unauthorized traffic flows from BIG-IP management interfaces

How to Mitigate CVE-2021-22987

Immediate Actions Required

• Identify all BIG-IP systems running in Appliance mode and determine their current software versions against the affected version list
• Restrict network access to the TMUI management interface to only authorized administrative workstations and IP ranges
• Review and audit all user accounts with access to the Configuration utility, removing unnecessary or inactive accounts
• Implement multi-factor authentication for TMUI access where supported to reduce credential-based attack risk
• Monitor affected systems for signs of compromise while planning upgrade activities

Patch Information

F5 has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions or later:

• Version 16.0.1.1 or later for the 16.0.x branch
• Version 15.1.2.1 or later for the 15.1.x branch
• Version 14.1.4 or later for the 14.1.x branch
• Version 13.1.3.6 or later for the 13.1.x branch
• Version 12.1.5.3 or later for the 12.1.x branch
• Version 11.6.5.3 or later for the 11.6.x branch

Refer to F5 Support Article K18132488 for detailed patching instructions and additional guidance.

Workarounds

• Restrict management interface access by configuring self IP port lockdown settings to limit TMUI access to specific trusted networks
• If possible, temporarily disable Appliance mode and implement alternative access controls until patches can be applied
• Use F5 iControl REST API with strict access controls as an alternative to TMUI for necessary administrative functions
• Deploy a web application firewall or reverse proxy in front of TMUI to filter malicious requests and add an additional layer of authentication

# Example: Restrict TMUI access to specific management network
# Run from BIG-IP CLI with tmsh
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/8 }
tmsh save sys config

# Verify current allowed networks
tmsh list sys httpd allow