PT-2022-3552 · F5 · Big-Ip Advanced Waf/Asm

Published 2022-01-25 · Updated 2022-02-01 · CVE-2022-23026

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions BIG-IP ASM & Advanced WAF versions 12.1.x through 16.1.x before 16.1.2 BIG-IP ASM & Advanced WAF versions 13.1.x BIG-IP ASM & Advanced WAF versions 14.1.x before 14.1.4.5 BIG-IP ASM & Advanced WAF versions 15.1.x before 15.1.4.1

Description The issue is related to an authenticated user with low privileges being able to upload data using an undisclosed REST endpoint, causing an increase in disk resource utilization. This could potentially allow a remote attacker to execute arbitrary code.

Recommendations For BIG-IP ASM & Advanced WAF versions 12.1.x, update to a version after 12.1.x or apply a configuration change to restrict access to the undisclosed REST endpoint. For BIG-IP ASM & Advanced WAF versions 13.1.x, update to a version after 13.1.x or apply a configuration change to restrict access to the undisclosed REST endpoint. For BIG-IP ASM & Advanced WAF versions 14.1.x before 14.1.4.5, update to version 14.1.4.5 or later. For BIG-IP ASM & Advanced WAF versions 15.1.x before 15.1.4.1, update to version 15.1.4.1 or later. For BIG-IP ASM & Advanced WAF versions 16.1.x before 16.1.2, update to version 16.1.2 or later. As a temporary workaround, consider restricting access to the undisclosed REST endpoint until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2022-04336

CVE-2022-23026

Affected Products

Big-Ip Advanced Waf/Asm

References · 6

• https://bdu.fstec.ru/vul/2022-04336 · Security Note
• https://support.f5.com/csp/article/K08402414 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23026 · Security Note
• https://t.me/cibsecurity/36260 · Telegram Post
• https://t.me/cvenotify/26122 · Telegram Post