CVE-2021-22991
published 2021-03-31CVE-2021-22991: On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed…
PriorityP195critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-02-01
Exploited in the wild
EPSS
61.06%
99.1th percentile
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Affected
85 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_aam | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | >= 12.1.0 < 12.1.5.3 | 12.1.5.3 |
| f5 | big-ip_access_policy_manager | >= 13.1.0 < 13.1.3.6 | 13.1.3.6 |
| f5 | big-ip_access_policy_manager | >= 14.1.0 < 14.1.4 | 14.1.4 |
| f5 | big-ip_access_policy_manager | >= 15.1.0 < 15.1.2.1 | 15.1.2.1 |
| f5 | big-ip_access_policy_manager | >= 16.0.0 < 16.0.1.1 | 16.0.1.1 |
| f5 | big-ip_advanced_firewall_manager | >= 12.1.0 < 12.1.5.3 | 12.1.5.3 |
| f5 | big-ip_advanced_firewall_manager | >= 13.1.0 < 13.1.3.6 | 13.1.3.6 |
| f5 | big-ip_advanced_firewall_manager | >= 14.1.0 < 14.1.4 | 14.1.4 |
| f5 | big-ip_advanced_firewall_manager | >= 15.1.0 < 15.1.2.1 | 15.1.2.1 |
| f5 | big-ip_advanced_firewall_manager | >= 16.0.0 < 16.0.1.1 | 16.0.1.1 |
| f5 | big-ip_advanced_waf | — | — |
| f5 | big-ip_advanced_web_application_firewall | >= 12.1.0 < 12.1.5.3 | 12.1.5.3 |
| f5 | big-ip_advanced_web_application_firewall | >= 13.1.0 < 13.1.3.6 | 13.1.3.6 |
| f5 | big-ip_advanced_web_application_firewall | >= 14.1.0 < 14.1.4 | 14.1.4 |
| f5 | big-ip_advanced_web_application_firewall | >= 15.1.0 < 15.1.2.1 | 15.1.2.1 |
| f5 | big-ip_advanced_web_application_firewall | >= 16.0.0 < 16.0.1.1 | 16.0.1.1 |
| f5 | big-ip_afm | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | >= 12.1.0 < 12.1.5.3 | 12.1.5.3 |
| f5 | big-ip_analytics | >= 13.1.0 < 13.1.3.6 | 13.1.3.6 |
| f5 | big-ip_analytics | >= 14.1.0 < 14.1.4 | 14.1.4 |
| f5 | big-ip_analytics | >= 15.1.0 < 15.1.2.1 | 15.1.2.1 |
| f5 | big-ip_analytics | >= 16.0.0 < 16.0.1.1 | 16.0.1.1 |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible F5 BIG-IP Infoleak and Out-of-Bounds Write Inbound (CVE-2021-22991)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"|3a 2f 2f 5b|"; fast_pattern; content:"|5d|"; endswith; reference:url,bugs.chromium.org/p/project-zero/issues/detail?id=2126; reference:cve,2021-22991; classtype:attempted-admin; sid:2032173; rev:1; metadata:attack_target Server, created_at 2021_03_18, cve CVE_2021_22991, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_03_18;)
bytes
|3a 2f 2f 5b|
- →Look for inbound HTTP GET requests to virtual servers where the URI contains the byte sequence |3a 2f 2f 5b| (://[) with a closing |5d| (]) at the end — this pattern targets the TMM URI normalization buffer overflow via malformed URI with bracket notation.
- →The vulnerability is triggered by undisclosed requests to a BIG-IP virtual server that are incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization — monitor TMM process crashes or unexpected restarts as a DoS indicator.
- →In addition to DoS, successful exploitation may allow bypass of URL-based access controls or RCE — correlate TMM crashes with any subsequent unauthorized access to protected URL paths.
- ·Affected BIG-IP versions span multiple branches; ensure patching targets all in-scope versions: 12.1.0–12.1.5.3, 13.1.0–13.1.3.6, 14.1.0–14.1.4, 15.1.0–15.1.2.1, and 16.0.0–16.0.1.1. ↗
- ·The vulnerability affects a broad set of BIG-IP modules (AAM, AFM, APM, ASM, Advanced WAF, Analytics, DHD, DNS, FPS, GTM, LTM, Link Controller, PEM, SSL Orchestrator) — detection and patching scope must cover all deployed modules. ↗
- ·BIG-IP versions that have reached End of Software Development (EoSD) are not evaluated for this CVE — do not assume unpatched EoSD versions are safe; they remain vulnerable. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
F5 BIG-IP Traffic Management Microkernel Buffer Overflow
cisa·2022-01-18·CVSS 9.8
CVE-2021-22991 [CRITICAL] CWE-119 F5 BIG-IP Traffic Management Microkernel Buffer Overflow
Vulnerability: F5 BIG-IP Traffic Management Microkernel Buffer Overflow
Affected: F5 BIG-IP Traffic Management Microkernel
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-22991
Remediation Due Date: 2022-02-01
F5
CVE-2021-22991: On BIG-IP versions 16
vendor_f5·2021-03-31·CVSS 9.8
CVE-2021-22991 [CRITICAL] CWE-119 CVE-2021-22991: On BIG-IP versions 16
CVE-2021-22991: On BIG-IP versions 16
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Affected Products: BIG-IP AAM, BIG-IP AFM, BIG-IP APM, BIG-IP ASM, BIG-IP Advanced WAF, BIG-IP Analytics, BIG-IP DHD, BIG-IP DNS, BIG-IP FPS, BIG-IP GTM, BIG-IP LTM, BIG-IP Link Controller, BIG-IP PEM, Ssl Orch
GHSA
GHSA-6w8r-pjm3-q7x7: On BIG-IP versions 16
ghsa_unreviewed·2022-05-24
CVE-2021-22991 [CRITICAL] CWE-119 GHSA-6w8r-pjm3-q7x7: On BIG-IP versions 16
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
VulnCheck
F5 BIG-IP Traffic Management Microkernel Buffer Overflow
vulncheck·2021·CVSS 9.8
CVE-2021-22991 [CRITICAL] CWE-119 F5 BIG-IP Traffic Management Microkernel Buffer Overflow
F5 BIG-IP Traffic Management Microkernel Buffer Overflow
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
Affected: F5 BIG-IP Traffic Management Microkernel
Required Action: Apply updates per vendor instructions.
Exploitation References: https://unit42.paloaltonetworks.com/network-attack-trends-february-april-2021/; https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-02-01
Suricata
ET EXPLOIT Possible F5 BIG-IP Infoleak and Out-of-Bounds Write Inbound (CVE-2021-22991)
suricata·2021-03-18·CVSS 9.8
CVE-2021-22991 [CRITICAL] ET EXPLOIT Possible F5 BIG-IP Infoleak and Out-of-Bounds Write Inbound (CVE-2021-22991)
ET EXPLOIT Possible F5 BIG-IP Infoleak and Out-of-Bounds Write Inbound (CVE-2021-22991)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible F5 BIG-IP Infoleak and Out-of-Bounds Write Inbound (CVE-2021-22991)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"|3a 2f 2f 5b|"; fast_pattern; content:"|5d|"; endswith; reference:url,bugs.chromium.org/p/project-zero/issues/detail?id=2126; reference:cve,2021-22991; classtype:attempted-admin; sid:2032173; rev:1; metadata:attack_target Server, created_at 2021_03_18, cve CVE_2021_22991, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_03_18;)
No public exploits indexed.
Unit42
Network Attack Trends: February-April 2021
blogs_unit42·2021-07-01
Network Attack Trends: February-April 2021
## Executive Summary
Unit 42 researchers observed network attack trends, February-April 2021. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity and category. Additionally, we provide insight into how the vulnerabilities are actively exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls. We then draw conclusions about the most commonly exploited vulnerabilities the attackers are using, as well as the severity, category and origin of each attack.
## Network Attack Trends February-April 2021: Analysis of the Latest Published Vulnerabilities
From February-April 2021, a total of 4,969 new Common Vulnerabilities and Exposures (CVE) numbers were registered. To better und
Unit42
Network Attack Trends: February-April 2021
blogs_unit42·2021-07-01
Network Attack Trends: February-April 2021
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: February-April 2021
Yue Guan
Lei Xu
Vaibhav Singhal
Brock Mammen
Published: July 1, 2021
Trend Reports
Vulnerabilities
Network security trends
## Executive Summary
Unit 42 researchers observed network attack trends, February-April 2021. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity and category. Additionally, we provide insight into how the vulnerabilities are actively exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls . We then draw conclusions about the most commonly exploited vulnerabilities the attackers are using, as well as the severity, category and origin of
Fortinet
The Ghosts of Mirai | FortiGuard Labs
blogs_fortinet·2021-06-24
The Ghosts of Mirai | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
The Ghosts of Mirai
By David Maciejak and Joie Salvio | June 24, 2021
FortiGuard Labs Threat Research Report
Affected Platforms: Linux
Impacted Users: Any organization
Impact: Remote attackers gain control of the vulnerable systems
Severity Level: Critical
It has been almost five years since the source code of the notorious MIRAI IoT malware was released to the public by its author in late 2016. This event led to the emergence of numerous copycats, creating their own flavors of IoT botnet armies. Although improvements have been constantly added since then by various threat actors, the structure and goal of the campaigns have remained the same.
IoT malware scans the Internet for IoT devices that use default or weak usernames and passwords. They also seek
Fortinet
Defending Against Critical F5 Vulnerabilities | FortiGuard Labs
blogs_fortinet·2021-03-23·CVSS 9.8
[CRITICAL] Defending Against Critical F5 Vulnerabilities | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Defending Against Critical F5 Vulnerabilities
By FortiGuard Labs | March 23, 2021
FortiGuard Labs Threat Update
FortiGuard Labs has been actively monitoring efforts by attackers around the world to scan for and locate devices vulnerable to recently revealed flaws in the F5 BIG-IP/BIG-IQ family of application availability, access control, and security solutions. In addition, we have identified multiple instances of new proof of concept code being posted to known sites that could be used to exploit these vulnerabilities, further demonstrating the need to apply patches quickly.
F5 BIG-IP is an application delivery controller (ADC) used for load balancing and facilitating the movement of web traffic to its destination, and BIG-IQ provides centralized manage
Tenable
CVE-2021-22986: F5 Patches Several Critical Vulnerabilities in BIG-IP, BIG-IQ
blogs_tenable·2021-03-11·CVSS 9.8
[CRITICAL] CVE-2021-22986: F5 Patches Several Critical Vulnerabilities in BIG-IP, BIG-IQ
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
2021-03-31
Published
2022-01-18
Added to CISA KEV
Exploited in the wild