CVE-2024-27202: F5 BIG-IP APM DOM-Based XSS Vulnerability

CVE-2024-27202 Overview

CVE-2024-27202 is a DOM-based cross-site scripting (XSS) vulnerability in the F5 BIG-IP Configuration utility. An undisclosed page in the management interface fails to properly sanitize client-side input, allowing an attacker to execute arbitrary JavaScript in the context of the logged-in user. Exploitation requires user interaction, such as convincing an authenticated administrator to click a crafted link. Successful exploitation can lead to session manipulation, configuration changes, or information disclosure within the BIG-IP management plane. F5 published advisory K000138520 to track the issue. Software versions that have reached End of Technical Support (EoTS) were not evaluated.

Critical Impact
An attacker can execute JavaScript in an authenticated administrator's browser session, enabling unauthorized actions within the BIG-IP Configuration utility.

Affected Products

F5 BIG-IP Access Policy Manager (APM), Advanced Firewall Manager (AFM), and Advanced Web Application Firewall (AWAF)
F5 BIG-IP Local Traffic Manager (LTM), Global Traffic Manager (GTM/DNS), and Link Controller
F5 BIG-IP Application Security Manager (ASM), SSL Orchestrator, Policy Enforcement Manager (PEM), and additional BIG-IP modules listed in advisory K000138520

Discovery Timeline

2024-05-08 - CVE-2024-27202 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27202

Vulnerability Analysis

The flaw is a client-side DOM-based XSS [CWE-79] within the BIG-IP Configuration utility, the web-based management interface used to administer BIG-IP appliances. In DOM-based XSS, attacker-controlled data flows from a source such as document.location, document.URL, or window.name into a dangerous sink such as innerHTML, document.write, or eval without proper encoding. The injected script runs with the privileges of the current session.

Because the Configuration utility typically runs under a privileged administrative account, script execution can read page content, submit forms, change configuration, or exfiltrate session artifacts. F5 marks the attack complexity as high and the scope as changed, indicating the attacker must satisfy specific preconditions and that impact crosses a trust boundary within the management plane.

Root Cause

The root cause is improper neutralization of input used in the construction of a web page element, as classified by CWE-79. Client-side JavaScript in an undisclosed page of the Configuration utility consumes untrusted data from the DOM and writes it into a sink without context-aware output encoding or input validation.

Attack Vector

Exploitation is network-based but requires user interaction. An attacker crafts a URL or page containing a malicious payload and persuades an authenticated BIG-IP administrator to open it. When the Configuration utility processes the attacker-controlled fragment or parameter, the payload is injected into the DOM and executed in the admin's browser. The attacker cannot execute code directly on the BIG-IP system through this flaw, but can perform any action the authenticated user is authorized to perform.

No verified public exploit or proof-of-concept has been released. See the F5 Security Advisory K000138520 for the authoritative technical description.

Detection Methods for CVE-2024-27202

Indicators of Compromise

Access log entries to the BIG-IP Configuration utility containing suspicious URL fragments, encoded <script> tags, or javascript: schemes in query strings.
Unexpected administrative actions (user creation, configuration changes, iRule modifications) performed shortly after an admin clicked an external link.
Browser console errors or unusual outbound requests originating from the management interface to attacker-controlled domains.

Detection Strategies

Inspect HTTP request/response traffic to the TMUI (Traffic Management User Interface) for payloads containing script tags, event handlers (onerror, onload), or encoded JavaScript in URL fragments.
Correlate administrator browser activity with configuration change events in audit logs to identify actions triggered by XSS rather than deliberate admin input.
Deploy a Content Security Policy (CSP) reporting endpoint to capture inline script violations originating from the Configuration utility.

Monitoring Recommendations

Forward BIG-IP audit, restjavad, and HTTPD access logs to a centralized logging platform for anomaly review.
Alert on administrator sessions that originate from unusual source IPs or user-agents, particularly following inbound referrer traffic from untrusted domains.
Monitor outbound connections from administrator workstations to newly registered or low-reputation domains during active TMUI sessions.

How to Mitigate CVE-2024-27202

Immediate Actions Required

Apply the fixed software versions documented in F5 Security Advisory K000138520.
Restrict access to the BIG-IP Configuration utility to a dedicated management network and trusted jump hosts only.
Require administrators to use a dedicated, hardened browser profile for BIG-IP management and avoid browsing untrusted sites in the same session.

Patch Information

F5 has released fixed software versions as detailed in advisory K000138520. Review the advisory's affected-versions table and upgrade each BIG-IP module to a version listed as not vulnerable. Versions that have reached End of Technical Support are not evaluated and should be upgraded to a currently supported branch.

Workarounds

Limit TMUI exposure to the management interface and block administrative access from data-plane VLANs and the public internet.
Enforce short session timeouts in the Configuration utility to reduce the window of exploitability for authenticated admins.
Require administrators to log out of TMUI before browsing other sites, and consider enforcing this via browser isolation or a privileged access workstation.

bash

# Restrict management access to trusted subnets on BIG-IP
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/24 192.168.100.0/24 }
tmsh save sys config