CVE-2021-22988: F5 BIG-IP Access Policy Manager RCE Flaw

CVE-2021-22988 Overview

CVE-2021-22988 is an authenticated remote command execution vulnerability affecting F5 BIG-IP's Traffic Management User Interface (TMUI), also known as the Configuration utility. This vulnerability exists in undisclosed pages within the TMUI component and allows an authenticated attacker to execute arbitrary commands on the underlying system. Given the critical role that BIG-IP devices play in enterprise network infrastructure—handling traffic management, load balancing, and security functions—successful exploitation could lead to complete compromise of the affected appliance and potentially the broader network environment.

Critical Impact

Authenticated attackers can execute arbitrary system commands through the TMUI web interface, potentially leading to full system compromise, data exfiltration, and lateral movement within the network infrastructure.

Affected Products

• F5 BIG-IP Access Policy Manager (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Advanced Firewall Manager (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Advanced Web Application Firewall (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Analytics (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Application Acceleration Manager (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Application Security Manager (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP DDoS Hybrid Defender (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Domain Name System (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 BIG-IP Local Traffic Manager (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)
• F5 SSL Orchestrator (versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, 11.6.x before 11.6.5.3)

Discovery Timeline

• March 31, 2021 - CVE-2021-22988 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-22988

Vulnerability Analysis

This vulnerability resides in the TMUI (Traffic Management User Interface), which serves as the primary web-based management console for F5 BIG-IP devices. The vulnerability enables authenticated users to execute arbitrary commands on the underlying operating system through certain undisclosed pages within the interface.

The attack requires valid credentials with access to the TMUI, meaning the attacker must first authenticate to the management interface. However, once authenticated, even users with limited privileges may be able to exploit this vulnerability to escalate their access and execute commands with the privileges of the underlying system process. This could allow attackers to modify system configurations, access sensitive data, install backdoors, or pivot to other systems in the network.

The network-based attack vector means that any authenticated user who can reach the TMUI over the network could potentially exploit this vulnerability. Organizations that expose their BIG-IP management interfaces to untrusted networks face increased risk.

Root Cause

The vulnerability stems from insufficient input validation and improper handling of user-supplied data within certain pages of the TMUI web application. When processing requests to these undisclosed endpoints, the application fails to properly sanitize or validate input before passing it to system-level command execution functions. This lack of input validation allows an authenticated attacker to inject malicious commands that are subsequently executed by the underlying operating system.

Attack Vector

An attacker exploiting CVE-2021-22988 would follow this general attack pattern:

1. Authentication: The attacker first authenticates to the BIG-IP TMUI using valid credentials. These credentials could be obtained through credential theft, phishing, brute force attacks, or insider access.

2. Access Vulnerable Endpoint: The attacker navigates to or crafts requests to the undisclosed vulnerable pages within the TMUI.

3. Command Injection: By manipulating input parameters sent to these pages, the attacker injects operating system commands into the request.

4. Command Execution: The vulnerable application processes the malicious input without proper sanitization, resulting in the injected commands being executed on the BIG-IP system.

5. Post-Exploitation: With command execution achieved, the attacker can perform various malicious activities including installing persistent access mechanisms, exfiltrating configuration data and secrets, modifying traffic rules, or using the compromised device as a pivot point for lateral movement.

The specific vulnerable pages and exploitation parameters have not been publicly disclosed by F5 to prevent widespread exploitation. Refer to the F5 Support Article K70031188 for detailed technical information and mitigation guidance.

Detection Methods for CVE-2021-22988

Indicators of Compromise

• Unusual or unexpected processes spawned by the TMUI web server processes (such as httpd or related Apache processes)
• Anomalous system commands executed by user accounts associated with the web interface
• Unexpected network connections originating from the BIG-IP management plane
• Modified system files or configurations that were not changed through normal administrative procedures
• Presence of unfamiliar scripts, binaries, or scheduled tasks on the BIG-IP system

Detection Strategies

• Monitor TMUI access logs for unusual request patterns, especially to administrative endpoints with suspicious parameter values
• Implement behavioral analysis on BIG-IP systems to detect anomalous command execution patterns
• Deploy network monitoring to identify unexpected outbound connections from BIG-IP management interfaces
• Review authentication logs for unusual login patterns or access from unexpected source IP addresses
• Utilize SentinelOne Singularity platform to detect post-exploitation activities and command execution anomalies on network appliances

Monitoring Recommendations

• Enable comprehensive logging for the TMUI interface and forward logs to a centralized SIEM solution
• Implement alerting on authentication events to the TMUI from non-standard administrative IP ranges
• Monitor for process creation events and shell spawning on BIG-IP systems
• Track configuration changes on BIG-IP devices and alert on unauthorized modifications

How to Mitigate CVE-2021-22988

Immediate Actions Required

• Apply the appropriate security patches from F5 immediately for all affected BIG-IP versions
• Restrict access to the TMUI interface to trusted administrative networks only using firewall rules or self IP port lockdown
• Enforce strong authentication policies including multi-factor authentication for TMUI access where supported
• Review user accounts with TMUI access and remove unnecessary privileges
• Monitor for signs of compromise on all BIG-IP devices in the environment

Patch Information

F5 has released security updates that address this vulnerability. Organizations should update to the following minimum versions:

• Version 16.0.x: Update to 16.0.1.1 or later
• Version 15.1.x: Update to 15.1.2.1 or later
• Version 14.1.x: Update to 14.1.4 or later
• Version 13.1.x: Update to 13.1.3.6 or later
• Version 12.1.x: Update to 12.1.5.3 or later
• Version 11.6.x: Update to 11.6.5.3 or later

Detailed patch information and download links are available in the F5 Support Article K70031188.

Workarounds

• Restrict TMUI access to only trusted internal networks by configuring self IP port lockdown settings
• Use F5's built-in access controls to limit which IP addresses can access the management interface
• Consider disabling TMUI access entirely if CLI-only management is feasible for your environment
• Implement network segmentation to isolate BIG-IP management traffic from general network traffic

# Example: Restrict TMUI access using self IP port lockdown
# This limits management access to specific protocols and ports
tmsh modify net self <self_ip_name> allow-service add { tcp:443 }
tmsh modify net self <self_ip_name> allow-service delete { default }

# Verify the configuration
tmsh list net self <self_ip_name> allow-service