Affected Versions#

All versions.

Environment Setup#

Download the image from the official site and boot it with VMware:
https://my.f5.com/manage/s/downloads?productFamily=BIG-IP&productLine=big-ip_v15.x&version=15.1.8&container=Virtual-Edition&files=BIGIP-15.1.8-0.0.7.ALL-vmware.ova&locations=JAPAN

Default credentials: admin / default

Analysis & Reproduction#

From the official patch, it’s clearly related to authorization checks and modifies proxy_ajp_conf. Combined with existing public information, this strongly suggests an AJP request smuggling issue (and right when I had a rough validation, “chen” posted a one-liner…).


Opening it revealed a PoC, and comparing it with /usr/share/tomcat/conf/server.xml made it obvious:


That saves a lot of time: we can confirm it’s AJP smuggling. BIG-IP’s Apache is a customized build based on Apache 2.4.6, so it is also affected by AJP smuggling.

AJP smuggling is not new (e.g., Ghostcat, CVE-2022-26377). The exploitation chain here is:

1. From the historical BIG-IP vulnerability CVE-2022-1388, we know we can execute commands via /mgmt/tm/util/bash. But the old issue relied on bypassing X-F5-Auth-Token authorization. Since the bypass has been fixed, we now need a valid X-F5-Auth-Token — which means we need to create an admin user.

2. Creating users is handled in TMUI. We use AJP smuggling to reach /tmui/Control/form and invoke /tmui/system/user/create.jsp to create a new user.

3. Following the official documentation, after the user is created we can call /mgmt/shared/authn/login to obtain a token, then go back to step 1 to execute commands.

   

In short:

/tmui/Control/form → user/create.jsp → /mgmt/shared/authn/login (new token) → /mgmt/tm/util/bash (command execution)

One important caveat:

TMUI enforces CSRF checks. When invoking step 1, you must craft three parameters: _timenow, Tmui-Dubbuf, and _bufvalue, where _bufvalue must equal Tmui-Dubbuf + Tmui-Dubbuf.


In the nuclei PoC, the values are:

• Tmui-Dubbuf = BBBBBBBBBBB
• _timenow = a
• _bufvalue = eIL4RUnSwXYoPUIOGcOFx2o00Xc=


Using these values, the resulting PoC looks like this:


When using Transfer-Encoding: chunked, the request is sent in chunks. The first 204 is the chunk size; converting decimal 204 to hex gives cc. The final 0 marks the end. If you capture it without HTTPS, the plaintext looks like:


You may need to try multiple times; it may not succeed on the first attempt. Once the response is no longer the login page, proceed to the next step.

Obtain a token using the username/password:


Then execute a command: