CVE-2023-22358: F5 BIG-IP APM DLL Hijacking Vulnerability

CVE-2023-22358 Overview

A DLL hijacking vulnerability exists in the F5 BIG-IP Edge Client Windows Installer affecting versions 7.2.2 to before 7.2.3.1. This vulnerability allows a local attacker with user-level privileges to potentially execute arbitrary code with elevated privileges by placing a malicious DLL in a location that the installer loads during execution. The vulnerability affects the installation process of the BIG-IP Edge Client, which is used for remote access VPN connectivity.

Critical Impact

Local attackers can exploit this DLL hijacking vulnerability to achieve complete system compromise, including unauthorized code execution with elevated privileges, data exfiltration, and persistent access to affected systems.

Affected Products

• F5 BIG-IP Access Policy Manager (versions 7.2.2 to before 7.2.3.1)
• F5 BIG-IP Edge Client for Windows
• F5 BIG-IP Access Policy Manager Clients

Discovery Timeline

• February 1, 2023 - CVE-2023-22358 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-22358

Vulnerability Analysis

This vulnerability falls under CWE-427 (Uncontrolled Search Path Element), a class of vulnerabilities where an application searches for critical resources using an externally-controlled search path. In the case of the BIG-IP Edge Client Windows Installer, the application fails to properly validate or restrict the directories from which it loads DLL files during the installation process.

When the installer executes, it attempts to load required DLLs following the Windows DLL search order. If the installer does not specify absolute paths for required libraries, Windows will search through a predefined sequence of directories. An attacker with local access can exploit this behavior by placing a malicious DLL with the expected filename in a directory that is searched before the legitimate DLL location.

The attack requires local access and user-level privileges, meaning an attacker must either have physical access to the target machine or have already established a foothold through another vector. Once the malicious DLL is loaded, the code executes within the context of the installer process, which may run with elevated privileges.

Root Cause

The root cause of CVE-2023-22358 is the improper handling of DLL loading paths in the BIG-IP Edge Client Windows Installer. The installer does not use absolute paths when loading required DLL files, allowing the Windows loader to search through the default DLL search path. This uncontrolled search path element permits an attacker to inject a malicious DLL into a location that is checked before the intended system directories, resulting in the execution of attacker-controlled code.

Attack Vector

The attack vector is local, requiring the attacker to have some level of access to the target system. The exploitation scenario typically involves:

1. An attacker gains local access to a system where the BIG-IP Edge Client installer will be executed
2. The attacker identifies the DLL files that the installer attempts to load
3. The attacker places a crafted malicious DLL with the appropriate filename in a directory that precedes the legitimate DLL location in the search order (such as the current working directory or a user-writable path)
4. When an administrator or user runs the installer, the malicious DLL is loaded and executed

The vulnerability requires no user interaction beyond the normal installation process, and the attacker needs only low-level user privileges to place the malicious DLL file.

Detection Methods for CVE-2023-22358

Indicators of Compromise

• Unexpected DLL files in user-writable directories that match names of legitimate system DLLs
• Installation processes loading DLLs from non-standard locations such as %TEMP% or the current working directory
• Anomalous process behavior during BIG-IP Edge Client installation
• Presence of unsigned or suspiciously signed DLL files in installation directories

Detection Strategies

• Monitor for DLL load events from the BIG-IP Edge Client installer process that reference non-standard paths
• Implement application allowlisting to prevent unauthorized DLLs from loading during installation procedures
• Use endpoint detection and response (EDR) solutions to identify DLL sideloading attempts
• Configure Windows Event Logging to capture process creation and module loading events

Monitoring Recommendations

• Enable Sysmon logging with specific rules for DLL loading events (Event ID 7)
• Monitor installation directories and user-writable paths for newly created DLL files
• Implement file integrity monitoring on systems where BIG-IP Edge Client installations occur
• Review security logs for installation processes that exhibit unexpected behavior

How to Mitigate CVE-2023-22358

Immediate Actions Required

• Upgrade the BIG-IP Edge Client to version 7.2.3.1 or later as recommended by F5
• Audit systems for evidence of exploitation prior to patching
• Restrict user write permissions on directories that are searched for DLLs during installation
• Run installers only from trusted locations with restricted write access

Patch Information

F5 has addressed this vulnerability in BIG-IP Edge Client version 7.2.3.1 and later releases. Organizations should consult the F5 Security Advisory K76964818 for detailed patch information and download links. Note that software versions that have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.

Workarounds

• Execute the BIG-IP Edge Client installer from a protected directory where standard users do not have write permissions
• Verify the integrity of the installer and associated files before execution using cryptographic hashes
• Use application control solutions to prevent unauthorized DLLs from loading during installation
• Implement the principle of least privilege to limit the potential impact if exploitation occurs

# Configuration example - Verify installer integrity before execution
# Calculate SHA256 hash of the installer and compare against known good value
certutil -hashfile BIGIPEdgeClient.exe SHA256