CVE-2024-33604: F5 BIG-IP APM XSS Vulnerability

CVE-2024-33604 Overview

CVE-2024-33604 is a reflected cross-site scripting (XSS) vulnerability in an undisclosed page of the F5 BIG-IP Configuration utility. An attacker can craft a malicious URL that, when visited by an authenticated administrator, executes attacker-supplied JavaScript in the context of the logged-in user session. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and carries a CVSS score of 6.1. F5 notes that software versions which have reached End of Technical Support (EoTS) are not evaluated. Exploitation requires user interaction, typically through phishing or a crafted link delivered to a BIG-IP administrator.

Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in an authenticated administrator's browser session, enabling session hijacking, configuration tampering, or pivoting into managed BIG-IP infrastructure.

Affected Products

F5 BIG-IP Access Policy Manager, Advanced Firewall Manager, Advanced Web Application Firewall
F5 BIG-IP Local Traffic Manager, Global Traffic Manager, DNS, Link Controller, SSL Orchestrator
F5 BIG-IP Analytics, Application Security Manager, Policy Enforcement Manager, and additional BIG-IP modules sharing the Configuration utility

Discovery Timeline

2024-05-08 - CVE-2024-33604 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33604

Vulnerability Analysis

The BIG-IP Configuration utility is the web-based management interface used by administrators to configure BIG-IP modules. CVE-2024-33604 exists because an undisclosed page in this interface reflects attacker-controlled input back into the rendered HTML response without proper output encoding or contextual sanitization. When an authenticated administrator loads a crafted URL, the browser interprets the reflected payload as executable JavaScript inside the origin of the management interface.

Because the payload executes in the administrator's authenticated context, it inherits every privilege of that session. Attackers can read or modify BIG-IP configuration data, invoke management API endpoints, and manipulate the interface DOM. The CWE-79 classification and network attack vector confirm the flaw is triggered client-side after a social engineering step delivers the malicious link.

Root Cause

The root cause is missing or insufficient output encoding on a request parameter reflected by an undisclosed Configuration utility page. F5 has not published the specific parameter or page name in the public advisory. The absence of a Content Security Policy strict enough to block inline execution allows the reflected payload to run.

Attack Vector

Exploitation requires an attacker to deliver a specially crafted URL to a user who is already authenticated to the BIG-IP Configuration utility. Common delivery methods include phishing emails, malicious chat messages, or attacker-controlled web pages that redirect the victim. No credentials are required by the attacker, but user interaction is mandatory. The scope change in the CVSS vector reflects the ability to affect resources beyond the vulnerable component, such as administrator browser state and downstream managed devices.

The vulnerability affects an undisclosed page in the BIG-IP Configuration utility.
F5 has not published exploitation details or proof-of-concept code.
See the F5 Support Article K000138894 for vendor-provided technical guidance.

Detection Methods for CVE-2024-33604

Indicators of Compromise

Requests to the BIG-IP Configuration utility containing HTML or JavaScript metacharacters such as <script>, onerror=, javascript:, or URL-encoded equivalents (%3Cscript%3E) in query strings
Unexpected outbound requests from administrator workstations to unfamiliar domains shortly after BIG-IP management interface access
Anomalous administrative actions (new users, configuration exports, iRule changes) originating from a legitimate admin session without a corresponding interactive login pattern

Detection Strategies

Inspect BIG-IP httpd and audit logs for management interface requests carrying reflected script payloads or unusual query parameters
Deploy web application firewall signatures for reflected XSS patterns targeting the BIG-IP management IP or hostname
Correlate email and web proxy telemetry for links referencing BIG-IP management URLs delivered to administrator inboxes

Monitoring Recommendations

Restrict the BIG-IP Configuration utility to a dedicated management network and monitor all inbound access at the perimeter
Alert on any Configuration utility access from non-management source ranges or outside expected administrator hours
Track browser telemetry on administrator endpoints for script execution originating from the BIG-IP origin followed by outbound callbacks

How to Mitigate CVE-2024-33604

Immediate Actions Required

Apply the fixed BIG-IP versions listed in F5 Support Article K000138894 to all affected instances
Restrict access to the Configuration utility to trusted management networks using Self IP port lockdown and network ACLs
Require administrators to log out of the Configuration utility when not actively managing the device to shrink the exploitation window

Patch Information

F5 has released fixed software versions for supported BIG-IP branches. Refer to F5 Support Article K000138894 for the authoritative list of fixed versions and upgrade guidance. Software versions that have reached End of Technical Support are not evaluated and should be upgraded to a supported branch.

Workarounds

Limit Configuration utility access to a dedicated, out-of-band management network and block internet exposure
Enforce administrator use of a hardened, isolated browser profile dedicated to BIG-IP management to prevent cross-context script access
Train administrators to avoid clicking unsolicited links referencing internal BIG-IP hostnames or management URLs

bash

# Restrict Configuration utility access via tmsh port lockdown
tmsh modify /sys httpd allow replace-all-with { 10.0.0.0/24 }
tmsh save /sys config

# Verify the management access list
tmsh list /sys httpd allow