CVE-2021-23037: F5 BIG-IP Access Policy Manager XSS Flaw

CVE-2021-23037 Overview

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the F5 BIG-IP Configuration utility. This vulnerability allows an attacker to execute JavaScript in the context of the currently logged-in user, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated administrators.

Critical Impact

This reflected XSS vulnerability in the BIG-IP Configuration utility could allow attackers to execute arbitrary JavaScript in the browser of authenticated administrators, potentially compromising entire network infrastructure managed through BIG-IP.

Affected Products

• F5 BIG-IP Access Policy Manager (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)
• F5 BIG-IP Advanced Firewall Manager (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)
• F5 BIG-IP Analytics (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)
• F5 BIG-IP Application Acceleration Manager (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)
• F5 BIG-IP Application Security Manager (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)
• F5 BIG-IP Domain Name System (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)
• F5 BIG-IP Fraud Protection Service (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)
• F5 BIG-IP Global Traffic Manager (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)
• F5 BIG-IP Link Controller (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)
• F5 BIG-IP Local Traffic Manager (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)
• F5 BIG-IP Policy Enforcement Manager (versions 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x)

Discovery Timeline

• September 14, 2021 - CVE-2021-23037 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-23037

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The reflected XSS flaw exists within an undisclosed page of the BIG-IP Configuration utility, which is the primary web-based management interface for F5 BIG-IP devices.

In a reflected XSS attack scenario, user-supplied input is immediately returned by the web application without proper sanitization or encoding. When an attacker crafts a malicious URL containing JavaScript payload and convinces an authenticated administrator to click it, the malicious script executes within the administrator's browser session with full access to the BIG-IP management interface.

The network-accessible nature of this vulnerability combined with the privileged context in which malicious code would execute makes this a significant security concern for organizations relying on BIG-IP for critical network infrastructure management.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the BIG-IP Configuration utility. The affected page fails to properly sanitize user-controlled input before reflecting it back in the HTTP response, allowing attackers to inject malicious JavaScript code that executes in the context of authenticated users' sessions.

Attack Vector

The attack requires user interaction, specifically requiring an authenticated administrator to click on a maliciously crafted link. The attacker must craft a URL containing the XSS payload and deliver it to the victim through social engineering techniques such as phishing emails, malicious websites, or compromised web pages.

Once the victim clicks the malicious link while authenticated to the BIG-IP Configuration utility, the attacker's JavaScript executes with the victim's privileges. This can enable session hijacking, theft of authentication tokens, modification of BIG-IP configurations, creation of backdoor accounts, or extraction of sensitive configuration data.

Detection Methods for CVE-2021-23037

Indicators of Compromise

• Unusual HTTP requests to the BIG-IP Configuration utility containing JavaScript code or encoded script tags in URL parameters
• Access logs showing requests with suspicious payloads such as <script>, javascript:, or encoded variants like %3Cscript%3E
• Unexpected administrative actions or configuration changes following user access to external links
• Session tokens being transmitted to external domains

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common XSS patterns in requests to the BIG-IP Configuration utility
• Configure SIEM alerts for HTTP requests containing script injection patterns targeting BIG-IP management interfaces
• Monitor authentication logs for sessions initiated immediately after suspicious referrer URLs
• Deploy browser-based XSS detection mechanisms for administrators accessing BIG-IP interfaces

Monitoring Recommendations

• Enable detailed access logging on BIG-IP Configuration utility and forward logs to a centralized SIEM platform
• Implement Content Security Policy (CSP) headers where possible to reduce XSS impact
• Monitor for anomalous administrative actions that may indicate compromised sessions
• Conduct regular security audits of BIG-IP access patterns and administrative activities

How to Mitigate CVE-2021-23037

Immediate Actions Required

• Apply the security patches provided by F5 for all affected BIG-IP products immediately
• Restrict network access to the BIG-IP Configuration utility to trusted management networks only
• Educate administrators about phishing risks and the importance of not clicking untrusted links while authenticated to management interfaces
• Consider implementing multi-factor authentication for BIG-IP administrative access to limit the impact of session compromise

Patch Information

F5 has released security updates to address this vulnerability. Organizations should consult the F5 Support Article K21435974 for detailed patch information, affected version matrices, and upgrade guidance. Versions that have reached End of Technical Support (EoTS) are not evaluated and should be upgraded to supported releases.

Workarounds

• Limit access to the BIG-IP Configuration utility by restricting it to trusted internal networks using firewall rules or BIG-IP's self IP access controls
• Use the TMSH command-line interface for administrative tasks instead of the web-based Configuration utility where possible
• Implement a web application firewall in front of the BIG-IP management interface to filter XSS payloads
• Deploy browser extensions or enterprise policies that block inline JavaScript execution on sensitive management interfaces

# Restrict Configuration utility access to management VLAN only
# Example TMSH command to modify httpd access settings
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 192.168.1.0/24 }
tmsh save sys config