F5 has warned of a serious format string vulnerability in BIG-IP that could allow an authenticated attacker to cause a denial-of-service and potentially execute malicious code. This security issue, tracked as CVE-2023-22374, affects iControl SOAP, an open API that allows communication between systems and runs as root. It is accessible from the network, either through the BIG-IP management port or self IP addresses, and is only available to administrative accounts. Rapid7, which discovered the bug, explains that exploitation is possible by inserting format string specifiers into certain parameters that are passed into the syslog function, which leads to the service reading and writing memory addresses from the stack. The attacker cannot read the memory unless they have access to the syslog. It is difficult to influence the specific addresses read and written, making this vulnerability hard to exploit in practice. An attacker could crash the service by using the %s specifier, and could use the %n specifier to write arbitrary data to any pointer in the stack, which could potentially lead to remote code execution. To exploit the flaw for code execution, an attacker would need to gather information about the environment running the vulnerable component. The most likely outcome of a successful attack is to crash the server process. A skilled attacker could potentially develop a remote code execution exploit, which would run code on the F5 BIG-IP device as the root user. The vulnerability affects BIG-IP versions 13.1.5, 14.1.4.6 to 14.1.5, 15.1.5.1 to 15.1.8, 16.1.2.2 to 16.1.3, and 17.0.0. F5 is working on an engineering hotfix, but no patch is currently available. To prevent exploitation, access to the iControl SOAP API should be limited to trusted users. CVE-2023-22374 has a CVSS score of 7.5 for BIG-IP systems in standard deployment mode, and a CVSS score of 8.5 for BIG-IP instances in application mode.
F5 has warned of a serious format string vulnerability in BIG-IP that could allow an authenticated attacker to cause a denial-of-service and potentially execute malicious code. This security issue, tracked as CVE-2023-22374, affects iControl SOAP, an open API that allows communication between systems and runs as root. It is accessible from the network, either through the BIG-IP management port or self IP addresses, and is only available to administrative accounts. Rapid7, which identified the bug, explains that exploitation is possible by inserting format string specifiers into certain parameters that are passed into the syslog function, resulting in the service reading and writing memory addresses from the stack. The attacker cannot read the memory unless they have access to the syslog. It is difficult to influence the specific addresses read and written, making this vulnerability hard to exploit in practice. An attacker could crash the service by using the %s specifier, and could use the %n specifier to write arbitrary data to any pointer in the stack, which could potentially lead to remote code execution. To exploit the flaw for code execution, an attacker would need to collect information about the environment running the vulnerable component. The most likely outcome of a successful attack is to crash the server process. A skilled attacker could potentially develop a remote code execution exploit, which would run code on the F5 BIG-IP device as the root user. The vulnerability affects BIG-IP versions 13.1.5, 14.1.4.6 to 14.1.5, 15.1.5.1 to 15.1.8, 16.1.2.2 to 16.1.3, and 17.0.0. F5 is working on an engineering hotfix, but no patch is currently available. To prevent exploitation, access to the iControl SOAP API should be restricted to trusted users. CVE-2023-22374 has a CVSS score of 7.5 for BIG-IP systems in standard deployment mode, and a CVSS score of 8.5 for BIG-IP instances in application mode. F5 has warned of a high-severity format string vulnerability in BIG-IP that could allow an authenticated attacker to cause a denial-of-service condition and potentially execute arbitrary code. Tracked as CVE-2023-22374, the security defect impacts iControl SOAP, an open API that enables communication between systems, which runs as root. This interface is accessible from the network, either via the BIG-IP management port and/or self IP addresses, and is limited to administrative accounts. Rapid7, which identified the bug, explains that exploitation is possible by inserting format string specifiers into specific parameters that are passed into the syslog function, resulting in the service reading and writing memory addresses referenced
This Cyber News was published on www.securityweek.com. Publication date: Thu, 02 Feb 2023 18:13:02 +0000