CVE-2015-3628
published 2015-12-07CVE-2015-3628: The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0…
PriorityP273critical9CVSS 2.0
AVNACLAuSCCICAC
EXPLOIT
EPSS
68.48%
99.3th percentile
The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0 before 11.6.0 HF6, BIG-IP PSM 11.3.0 through 11.4.1, Enterprise Manager 3.1.0 through 3.1.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote authenticated users with the "Resource Administrator" role to gain privileges via an iCall (1) script or (2) handler in a SOAP request to iControl/iControlPortal.cgi.
Affected
97 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_application_acceleration_manager | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandexec /bin/sh -c "echo <base64>|base64 --decode ><payload_path>; chmod +x <payload_path>;<payload_path>"↗
- →Detect SOAP POST requests to /iControl/iControlPortal.cgi containing iCall/Script or iCall/PeriodicHandler namespace URNs, which are characteristic of CVE-2015-3628 exploitation attempts. ↗
- →Alert on SOAP requests to iControlPortal.cgi that include both iCall/Script create operations and iCall/PeriodicHandler create operations in sequence from the same source — this two-phase pattern (script upload then handler trigger) is the exploit's execution chain. ↗
- →Monitor for files dropped in /tmp with names matching the pattern '.<16 random alphanumeric chars>' (dot-prefixed hidden random filename) followed by base64-decode and chmod+x shell commands, indicative of the payload staging mechanism. ↗
- →Detect iCall script names matching 'script-<16 alphanumeric chars>' and handler names matching 'handler-<16 alphanumeric chars>' in iControl API calls or BIG-IP audit logs, as these are the naming patterns generated by the exploit module. ↗
- →A SOAP response body containing 'iCall/PeriodicHandler' to a create request confirms successful handler creation and active exploitation; monitor for this in HTTP response inspection. ↗
- →The exploit requires the 'Resource Administrator' role; audit BIG-IP iControl API access logs for Resource Administrator accounts issuing iCall Script or PeriodicHandler create/delete SOAP calls, especially in rapid succession. ↗
- ·Exploitation requires valid credentials with the 'Resource Administrator' role; unauthenticated access is not sufficient. Detection rules should account for authenticated sessions. ↗
- ·The exploit targets BIG-IP 11.3.0 through 11.6.0 (specifically 11.5.x < 11.5.3 HF2 and 11.6.x < 11.6.0 HF6); detections should be scoped to these version ranges to reduce false positives on patched systems. ↗
- ·The exploit uses SSL (HTTPS) on port 443 by default; network-level detection must perform TLS inspection to inspect SOAP request bodies. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
F5 iControl - 'iCall::Script' Root Command Execution (Metasploit)
exploitdb·2015-11-19
CVE-2015-3628 F5 iControl - 'iCall::Script' Root Command Execution (Metasploit)
F5 iControl - 'iCall::Script' Root Command Execution (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'nokogiri'
class Metasploit3 "http://schemas.xmlsoap.org/soap/encoding/" }
STRING_ATTRS = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' }
LONG_ATTRS = { 'xsi:type' => 'urn:Common.ULongSequence', 'soapenc:arrayType' => 'xsd:long[]', 'xmlns:urn' => 'urn:iControl' }
def initialize(info = {})
super(
update_info(
info,
'Name' => "F5 iControl iCall::Script Root Command Execution",
'Description' => %q{
This module exploits an authenticated privilege escalation
vulnerability in the iControl API o
Metasploit
F5 iControl iCall::Script Root Command Execution
metasploit
F5 iControl iCall::Script Root Command Execution
F5 iControl iCall::Script Root Command Execution
This module exploits an authenticated privilege escalation vulnerability in the iControl API on the F5 BIG-IP LTM (and likely other F5 devices). This requires valid credentials and the Resource Administrator role. The exploit should work on BIG-IP 11.3.0 - 11.6.0, (11.5.x < 11.5.3 HF2 or 11.6.x < 11.6.0 HF6, see references for more details)
No writeups or analysis indexed.
http://packetstormsecurity.com/files/134434/F5-iControl-iCall-Script-Root-Command-Execution.htmlhttp://www.rapid7.com/db/modules/exploit/linux/http/f5_icall_cmdhttp://www.securitytracker.com/id/1034306http://www.securitytracker.com/id/1034307https://gdssecurity.squarespace.com/labs/2015/9/8/f5-icallscript-privilege-escalation-cve-2015-3628.htmlhttps://support.f5.com/kb/en-us/solutions/public/16000/700/sol16728.htmlhttps://www.exploit-db.com/exploits/38764/http://packetstormsecurity.com/files/134434/F5-iControl-iCall-Script-Root-Command-Execution.htmlhttp://www.rapid7.com/db/modules/exploit/linux/http/f5_icall_cmdhttp://www.securitytracker.com/id/1034306http://www.securitytracker.com/id/1034307https://gdssecurity.squarespace.com/labs/2015/9/8/f5-icallscript-privilege-escalation-cve-2015-3628.htmlhttps://support.f5.com/kb/en-us/solutions/public/16000/700/sol16728.htmlhttps://www.exploit-db.com/exploits/38764/
2015-12-07
Published