CVE-2022-1388 BIG-IP_POC-YAML

Send request:

- path
  {{BaseURL}}/mgmt/shared/authn/login
- matchers:
  words:
   - "resterrorresponse"
   - "message"
  status code:
   - 401

POC Manual

curl -sk --max-time 2 "https://{TARGET}/mgmt/shared/authn/login" | egrep  "message|resterrorresponse" | jq

{
    "code": 401,
    "message": "Authorization failed: no user authentication header or token detected. Uri:http://localhost:8100/mgmt/shared/authn/login   Referrer:xxx.xxx.177.228 Sender:xxx.xxx.177.228",
    "referer": "xxx.xxx.177.228",
    "restOperationId": 1461894338,
    "kind": ":resterrorresponse"
}

CVE-2022-1388——YAML

id: bigip-icontrol-rest

info:
  name: F5 BIG-IP iControl REST Panel
  severity: info
  description: |
   Undisclosed requests may bypass iControl REST authentication.

  metadata:
    shodan-query: http.title:"BIG-IP®-+Redirect" +"Server"
  classification:
    cve-id: CVE-2022-1388
    cwe-id: CWE-306
  tags: cve,cve2022,bigip,f5icontrol

requests:
  - method: GET
    path:
      - "{{BaseURL}}/mgmt/shared/authn/login"
    headers:
      User-Agent: "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0"

    matchers:
      - type: word
        part: body
        words:
          - "resterrorresponse"
          - "message"
      - type: status
        status:
          - 401

免责声明 由于传播、利用本公众号所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，公众号及作者不为此承担任何责任，一旦造成后果请自行承担！如有侵权烦请告知，我们会立即删除并致歉。如需转载请注明出处，谢谢！