cbcvebase.
CVE-2022-41622
published 2022-12-07

CVE-2022-41622: In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have…

PriorityP271high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
87.99%
99.7th percentile
In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

77 ranges· showing 25
VendorProductVersion rangeFixed in
f5big-ip——
f5big-ip——
f5big-ip——
f5big-ip——
f5big-ip——
f5big-ip_aam——
f5big-ip_access_policy_manager——
f5big-ip_access_policy_manager13.1.0 – 13.1.5—
f5big-ip_access_policy_manager14.1.0 – 14.1.5—
f5big-ip_access_policy_manager15.1.0 – 15.1.8—
f5big-ip_access_policy_manager16.1.0 – 16.1.3—
f5big-ip_advanced_firewall_manager——
f5big-ip_advanced_firewall_manager13.1.0 – 13.1.5—
f5big-ip_advanced_firewall_manager14.1.0 – 14.1.5—
f5big-ip_advanced_firewall_manager15.1.0 – 15.1.8—
f5big-ip_advanced_firewall_manager16.1.0 – 16.1.3—
f5big-ip_afm——
f5big-ip_analytics——
f5big-ip_analytics——
f5big-ip_analytics13.1.0 – 13.1.5—
f5big-ip_analytics14.1.0 – 14.1.5—
f5big-ip_analytics15.1.0 – 15.1.8—
f5big-ip_analytics16.1.0 – 16.1.3—
f5big-ip_apm——
f5big-ip_application_acceleration_manager——

Detection & IOCsextracted from sources · hover to see the quote

path/iControl/iControlPortal.cgi↗
  • →Monitor for unexpected file writes to reboot-executed scripts (e.g., rc scripts) or login scripts on F5 BIG-IP systems, as the exploit writes a payload that executes at reboot or interactive login. ↗
  • →Detect CSRF exploitation attempts against the iControl SOAP API by monitoring for cross-origin or unexpected HTTP requests to the iControl SOAP endpoint from authenticated administrator sessions. ↗
  • →The exploit starts a rogue web server to lure an authenticated administrator; monitor for unexpected outbound connections or web server processes spawned on BIG-IP hosts, as well as administrator browsers being redirected to attacker-controlled sites. ↗
  • →File writes via iControl SOAP are performed as root; alert on root-owned file creation or modification in SELinux-writable locations on BIG-IP, particularly in script directories executed at boot or login. ↗
  • ·All versions of BIG-IP (13.1.0–17.0.0) and BIG-IQ (7.1.0, 8.0.0–8.2.0) are affected; End of Technical Support (EoTS) versions are not evaluated by F5. ↗
  • ·Exploitation requires an authenticated administrator to visit an attacker-controlled page; the attack surface is limited to scenarios where admin users can be socially engineered or redirected. ↗
  • ·SELinux on BIG-IP significantly limits the locations where the exploit's arbitrary file write can be leveraged for code execution; most writable paths are blocked. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.