{
  "Name": "F5 BIGIP iControl unauth RCE (CVE-2021-22986)",
  "Description": "F5 Big-IP, an application delivery platform for F5 Corporation, issued a security bulletin today, announcing seven security vulnerabilities related to Big-IP and Big-IQ.Among them, CVE-2021-22986 is an unauthenticated remote command execution vulnerability. Due to incomplete authentication of HTTP requests, it allows attackers to bypass permission authentication and access Big-IP REST API to execute commands by setting special HTTP headers.",
  "Product": "F5-BIGIP",
  "Homepage": "https://support.f5.com",
  "DisclosureDate": "2021-03-19",
  "Author": "go0p",
  "GifAddress": "https://raw.githubusercontent.com/gobysec/GobyVuls/master/F5/CVE-2021-22986/CVE-2021-22986.gif",
  "FofaQuery": "title=\"BIG-IP\" || app=\"F5-BIGIP\"",
  "Level": "3",
  "Impact": "This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only be exploited through the control plane and cannot be exploited through the data plane. Exploitation can lead to complete system compromise. The BIG-IP system in Appliance mode is also vulnerable.",
  "Recommendation": "",
  "References": [
    "http://fofa.so"
  ],
  "HasExp": true,
  "ExpParams": [
	{
	  "name": "cmd",
	  "type": "input",
	  "value": "whoami"
	}
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "data": "",
        "data_type": "text",
        "follow_redirect": true,
        "method": "GET",
        "uri": "/"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": null,
  "Tags": ["rce"],
  "CVEIDs": ["CVE-2021-22986"],
  "CVSSScore": "9.3",
  "AttackSurfaces": {
    "Application": ["F5-BIGIP"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}