CVE-2024-22093: F5 BIG-IP APM Remote Command Injection Flaw

CVE-2024-22093 Overview

CVE-2024-22093 is an authenticated command injection vulnerability in an undisclosed F5 BIG-IP iControl REST endpoint. The flaw affects multi-bladed systems running in appliance mode, a hardened configuration intended to restrict administrative access to the underlying operating system. A successful exploit allows an authenticated attacker with high privileges to cross the appliance mode security boundary and execute commands on the host. The issue is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command and impacts most BIG-IP modules across the 13.x through 17.x software trains.

Critical Impact
An authenticated administrator can bypass appliance mode restrictions on multi-bladed F5 BIG-IP systems and execute arbitrary commands, breaking a documented security boundary.

Affected Products

F5 BIG-IP (LTM, APM, ASM, AFM, Analytics, AAM, DNS, GTM, Link Controller, PEM, FPS) versions up to and including 17.1.0 running in appliance mode on multi-bladed hardware
F5 BIG-IQ Centralized Management (referenced in the affected product set)
Systems on End of Technical Support (EoTS) branches are not evaluated by the vendor

Discovery Timeline

2024-02-14 - CVE-2024-22093 published to NVD
2024-02-14 - F5 published knowledge base article K000137522
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22093

Vulnerability Analysis

The vulnerability resides in an undisclosed iControl REST endpoint exposed by the BIG-IP management plane. iControl REST is F5's HTTPS-based administrative API used to configure and orchestrate BIG-IP modules. On multi-bladed chassis systems, this endpoint fails to properly neutralize special characters passed in a request parameter before invoking a system-level command.

Appliance mode is designed to prevent administrators from reaching a root shell or executing arbitrary OS commands, even when they hold the Administrator role. Because the vulnerable endpoint composes a shell command from attacker-controlled input, an authenticated administrator can inject shell metacharacters and break out of the appliance mode sandbox. The scope change reflected in the metrics indicates that exploitation crosses the trust boundary between the REST management context and the underlying host.

Root Cause

The root cause is improper neutralization of command elements ([CWE-77]) in an iControl REST handler used only on multi-bladed platforms. Input intended as a configuration parameter is concatenated into a shell invocation without adequate quoting, escaping, or allow-list validation. Because appliance mode assumes REST handlers cannot reach OS-level primitives, the injection also constitutes a security boundary bypass rather than a simple privilege abuse.

Attack Vector

Exploitation requires network access to the management interface and valid authentication as a high-privilege user (typically the admin account or a role with configuration privileges). The attacker sends a crafted HTTPS request to the affected iControl REST endpoint on a multi-bladed BIG-IP running in appliance mode. Shell metacharacters embedded in a parameter value are executed by the host, yielding command execution outside the appliance mode restrictions.

No public proof-of-concept, exploit code, or CISA KEV listing is currently associated with this CVE. The vulnerable endpoint itself has been intentionally left undisclosed by F5.

Detection Methods for CVE-2024-22093

Indicators of Compromise

Authenticated iControl REST requests containing shell metacharacters such as `, $(, ;, |, &&, or newline sequences in parameter values
Unexpected child processes of the restjavad or restnoded daemons on multi-bladed BIG-IP hosts
New or modified files in administrator home directories, /var/tmp/, or /shared/tmp/ on affected blades following management API activity
Successful iControl REST logins from unusual source IPs immediately followed by non-standard endpoint access

Detection Strategies

Enable and forward BIG-IP audit logs (/var/log/audit, /var/log/restjavad.0.log) to a central SIEM for correlation with authentication events
Alert on iControl REST request bodies or query parameters containing shell metacharacters directed at administrative endpoints
Baseline expected REST endpoints used by orchestration tooling and flag calls to undocumented or rarely used paths
Monitor for process lineage anomalies where restjavad, restnoded, or Tomcat spawn shells such as bash, sh, or utilities like id, whoami, curl, or wget

Monitoring Recommendations

Restrict access to the BIG-IP management interface (TMUI/iControl REST) to a dedicated management VLAN and audit all administrative sessions
Continuously monitor administrator account usage and enforce multi-factor authentication on the management plane
Track configuration changes via BIG-IP audit events and correlate with source IP, session ID, and REST endpoint accessed

How to Mitigate CVE-2024-22093

Immediate Actions Required

Review the F5 Knowledge Base Article K000137522 and identify all multi-bladed BIG-IP systems running in appliance mode
Upgrade affected BIG-IP software to a fixed release listed in the F5 advisory for your maintenance train
Rotate credentials for all administrative accounts on affected devices and audit recent iControl REST activity for anomalous requests
Restrict management plane exposure so iControl REST is reachable only from trusted administrative networks

Patch Information

F5 has released fixed software versions across the affected BIG-IP maintenance trains. Refer to F5 Knowledge Base Article K000137522 for the exact patched builds and the mapping of affected versions to fixed releases. Software branches that have reached End of Technical Support are not evaluated and should be upgraded to a supported release.

Workarounds

Limit iControl REST access to trusted management networks using self IP port lockdown and packet filters
Restrict administrative role assignments so that only strictly necessary accounts hold configuration privileges on multi-bladed systems
Disable or block network access to the management interface from untrusted zones until patching is complete

bash

# Example: restrict management access via tmsh (illustrative only)
# Replace 10.0.0.0/24 with your administrative network
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 }
tmsh modify net self <self-ip-name> allow-service none
tmsh save sys config