Privilege Escalation in F5 BIG-IP TMUI

Executive Summary

This vulnerability in BIG-IP allows an authenticated user of any role to create administrative user accounts through an undisclosed request to the Traffic Management User Interface (TMUI). It is a control plane issue with no data plane exposure.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires authenticated access to the BIG-IP management interface (TMUI). To detect it, monitor for unexpected administrative account creation events in TMUI logs. Check for unusual user account modifications or additions, particularly those granting admin privileges. Review system logs for any requests to the TMUI that create new users.

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker with network access to the BIG-IP management interface could escalate privileges by creating administrative accounts. This could lead to full control over the BIG-IP system and its configurations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may lead to unauthorized administrative account creation, potentially violating access control requirements in GDPR and HIPAA. Unauthorized privilege escalation could result in unauthorized data access or modification, compromising data integrity and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the BIG-IP management interface to trusted networks and users. Review all administrative accounts for unauthorized creation and remove any suspicious accounts. Apply the latest security patches from F5 if available.

Useful 0 Not Useful 0