CVE-2024-21793: F5 BIG-IP Next Central Manager SQLi Flaw

CVE-2024-21793 Overview

An OData injection vulnerability exists in the F5 BIG-IP Next Central Manager API. This vulnerability allows unauthenticated attackers to remotely exploit the API endpoint to extract sensitive information from the system. OData (Open Data Protocol) injection is a type of injection attack where malicious OData query parameters are inserted into API requests to manipulate database queries, similar to SQL injection but targeting OData-enabled web services.

Critical Impact

Unauthenticated remote attackers can exploit this OData injection vulnerability to access confidential data from the BIG-IP Next Central Manager, potentially compromising network management infrastructure and exposing sensitive configuration details.

Affected Products

• F5 BIG-IP Next Central Manager (versions prior to security patch)

Discovery Timeline

• 2024-05-08 - CVE-2024-21793 published to NVD
• 2025-09-19 - Last updated in NVD database

Technical Details for CVE-2024-21793

Vulnerability Analysis

This OData injection vulnerability (CWE-89) affects the BIG-IP Next Central Manager API URI endpoint. OData injection occurs when user-supplied input is incorporated into OData queries without proper sanitization or parameterization. In this case, the API fails to adequately validate and sanitize query parameters before processing them, allowing attackers to inject malicious OData expressions.

The vulnerability is network-accessible, requires no privileges or user interaction to exploit, and can lead to unauthorized disclosure of confidential information. The attack complexity is low, making it accessible to attackers with moderate technical skills. While the vulnerability does not directly allow for data modification or system availability impact, the confidentiality breach can expose critical infrastructure management data.

Root Cause

The root cause of this vulnerability is improper input validation (CWE-89) in the OData query processing layer of the BIG-IP Next Central Manager API. The API endpoint fails to properly sanitize OData filter expressions and query parameters before they are processed, allowing injection of malicious query constructs that can extract unauthorized data.

Attack Vector

The attack is executed remotely over the network by sending specially crafted HTTP requests to the vulnerable API endpoint. An attacker can manipulate OData query parameters such as $filter, $select, or $expand to inject malicious expressions that bypass intended query restrictions. This allows the attacker to access data outside their authorized scope, potentially including sensitive configuration information, credentials, or other management data stored in the Central Manager.

The vulnerability does not require authentication, meaning any network attacker with access to the API endpoint can attempt exploitation. The attack targets the URI component of API requests, where OData query strings are parsed and executed.

Detection Methods for CVE-2024-21793

Indicators of Compromise

• Unusual or malformed OData query parameters in API request logs (e.g., suspicious $filter or $select expressions)
• Unexpected API requests to BIG-IP Next Central Manager from unauthorized IP addresses
• Anomalous data access patterns or bulk data retrieval attempts via the API
• Error messages in application logs indicating OData parsing failures or injection attempts

Detection Strategies

• Monitor API access logs for requests containing unusual OData query syntax or escape sequences
• Implement web application firewall (WAF) rules to detect and block OData injection patterns
• Deploy intrusion detection signatures targeting known OData injection techniques
• Analyze network traffic for unauthorized API communications to the Central Manager

Monitoring Recommendations

• Enable comprehensive logging on the BIG-IP Next Central Manager API endpoints
• Configure alerting for failed authentication attempts and anomalous API query patterns
• Implement rate limiting on API endpoints to detect and slow enumeration attempts
• Regularly audit API access logs for signs of reconnaissance or data exfiltration

How to Mitigate CVE-2024-21793

Immediate Actions Required

• Apply the security patch from F5 as documented in Knowledge Article K000138732
• Restrict network access to the BIG-IP Next Central Manager API to trusted management networks only
• Implement additional authentication controls if possible pending patching
• Review API access logs for evidence of exploitation attempts

Patch Information

F5 has released a security patch addressing this vulnerability. Administrators should consult the F5 Knowledge Article K000138732 for detailed patching instructions and information about fixed software versions. Organizations running versions that have reached End of Technical Support (EoTS) should prioritize upgrading to supported versions.

Workarounds

• Implement network segmentation to restrict API access to authorized management hosts only
• Deploy a web application firewall with OData injection detection rules in front of the Central Manager
• Use IP allowlisting to limit access to the management interface
• Monitor and alert on any API requests from unauthorized sources while awaiting patching

# Example: Restrict network access to management interface via firewall rules
# Allow only trusted management network to access the API
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP