CVE-2024-22389 Overview
CVE-2024-22389 affects F5 BIG-IP appliances deployed in high availability (HA) configurations. When an administrator updates an iControl REST API token, the change fails to synchronize to the peer device. This session management flaw (CWE-613) leaves stale tokens valid on the peer, extending the effective lifetime of authentication credentials beyond intended boundaries.
F5 published the advisory on February 14, 2024. The issue impacts multiple BIG-IP modules including Access Policy Manager, Advanced Firewall Manager, Local Traffic Manager, and Global Traffic Manager. Software versions past End of Technical Support (EoTS) were not evaluated.
Critical Impact
Authenticated attackers with high privileges can leverage unsynchronized iControl REST tokens on peer BIG-IP devices to compromise confidentiality, integrity, and availability of managed traffic and configuration.
Affected Products
- F5 BIG-IP (APM, AFM, ASM, Analytics, AAM, DNS, GTM, LTM, PEM, Link Controller, FPS) versions up to 17.1.0
- F5 BIG-IQ Centralized Management
- BIG-IP 17.1.0 fixed-version branch
Discovery Timeline
- 2024-02-14 - CVE-2024-22389 published to NVD alongside F5 advisory K32544615
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-22389
Vulnerability Analysis
The flaw lives in the configuration synchronization path between paired BIG-IP devices. iControl REST is F5's HTTPS-based management API used by administrators and automation tooling to configure BIG-IP modules. Tokens authenticate subsequent API calls without re-transmitting credentials.
In an HA pair, configuration state normally replicates from the active unit to the standby unit. This vulnerability breaks that assumption for token state. When an administrator rotates, revokes, or updates an iControl REST token on one node, the peer retains its prior token view. An attacker who previously obtained a token, or who compromises the peer through a separate path, can continue calling privileged endpoints on the out-of-sync device.
Root Cause
The root cause is an insufficient session expiration and replication defect (CWE-613). Token lifecycle events are not propagated across the HA link, so revocation or rotation on the active node does not invalidate the corresponding token records on the standby node. The two devices maintain divergent authentication state.
Attack Vector
Exploitation requires network access to the iControl REST interface and pre-existing high-privilege credentials or a valid token. The attacker targets the peer device directly using a token that the administrator believes has been rotated or revoked. Because iControl REST calls execute with administrative context, successful requests can modify traffic policies, exfiltrate configuration, or disrupt service on the affected node.
No public proof-of-concept exploit or CISA KEV listing exists for this issue. Consult the F5 Security Article K32544615 for module-specific fixed versions.
Detection Methods for CVE-2024-22389
Indicators of Compromise
- iControl REST authentication events on the standby or peer device using tokens that were rotated or revoked on the active node
- Configuration or policy changes on a peer device that do not correspond to changes on the active device
- API calls to /mgmt/shared/authz/tokens returning tokens that differ between HA members
Detection Strategies
- Compare token inventories on both HA members regularly and alert on mismatches
- Enable and centralize iControl REST audit logging from every BIG-IP node, not just the active one
- Correlate administrative token rotation events with subsequent API activity on the peer device
Monitoring Recommendations
- Forward BIG-IP audit and REST access logs to a central log platform for cross-node correlation
- Alert on iControl REST authentication from unexpected source addresses or outside change windows
- Track HA sync status and flag configurations where token state fails to converge across peers
How to Mitigate CVE-2024-22389
Immediate Actions Required
- Apply the fixed BIG-IP software versions listed in F5 advisory K32544615 to every device in the HA pair
- Restrict iControl REST access to a dedicated management network and trusted administrative hosts only
- Rotate and validate all iControl REST tokens on both HA members after patching, confirming synchronization
Patch Information
F5 released fixed software versions documented in F5 Security Article K32544615. Administrators must upgrade both nodes in the HA pair to matching fixed versions. Versions that have reached End of Technical Support were not evaluated and should be replaced with a supported release.
Workarounds
- Manually revoke iControl REST tokens on each HA member individually rather than relying on sync until the patch is applied
- Limit the number of accounts authorized to create iControl REST tokens and enforce short token lifetimes
- Place the management interface behind a bastion or jump host with per-session authentication
# Verify BIG-IP version and list active iControl REST tokens on each HA peer
tmsh show /sys version
curl -sk -u admin:PASSWORD https://<bigip-host>/mgmt/shared/authz/tokens | jq '.items[] | {name,userName,startTime,expirationMicros}'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
