CVE-2022-1388: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

CVE-2022-1388 is a critical authentication bypass vulnerability in F5 BIG-IP's iControl REST interface discovered in May 2022. The vulnerability affects multiple versions of F5 BIG-IP including versions 16.1.x (prior to 16.1.2.2), 15.1.x (prior to 15.1.5.1), 14.1.x (prior to 14.1.4.6), 13.1.x (prior to 13.1.5), and all 12.1.x and 11.6.x versions. The vulnerability has a CVSS score of 9.8 out of 10, indicating its critical severity (NVD, F5 Networks).

The vulnerability stems from an authentication bypass issue in the iControl REST component that allows undisclosed requests to bypass authentication. The exploitation involves manipulating HTTP headers, specifically by using the Connection header to remove the X-F5-Auth-Token and X-Forwarded-Host headers in proxied requests. This causes the Jetty application to treat external requests as local administrative ones, effectively bypassing authentication controls (SecPod).

When successfully exploited, this vulnerability allows an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. The impact is particularly severe as BIG-IP is used by 48 firms in the Fortune 50, with the healthcare and hospital industry being one of the major sectors affected (Hacker News).

F5 has released patches for affected versions: 16.1.2.2, 15.1.5.1, 14.1.4.6, and 13.1.5. For systems that cannot be immediately patched, F5 recommends three temporary mitigations: 1) Block iControl REST access through the self IP address, 2) Block iControl REST access through the management interface, and 3) Modify the BIG-IP httpd configuration. Note that versions 12.1.x and 11.6.x will not receive patches as they have reached end-of-life (F5 Networks).

The cybersecurity community responded quickly to the vulnerability disclosure, with researchers and experts emphasizing its critical nature and urging immediate patching. Security researchers from Horizon3 and Positive Technologies publicly announced their development of proof-of-concept exploits, leading to increased awareness and urgency in applying patches (Hacker News).