F5 BIG-IP DNS iControl REST and tmsh Command Injection Vulnerability Allowing Arbitrary Command Execution

A vulnerability exists in BIG-IP DNS when provisioned, allowing an authenticated attacker with Resource Administrator or Administrator role to execute arbitrary system commands with elevated privileges. This issue arises from an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command. In Appliance mode deployments, exploitation can enable the attacker to cross a security boundary. The vulnerability is classified as a command injection issue.

Impact

Exploitation allows authenticated attackers with the appropriate roles to execute arbitrary commands with higher privileges, potentially crossing security boundaries in Appliance mode deployments. In standard deployments, the vulnerability could be exploited to execute commands with elevated privileges, but without crossing any security boundaries.

Remediation

Users can upgrade to BIG-IP DNS version 21.0.0.1 or versions 17.5.1.4 or 17.1.3.1, depending on their current version. For more information about managing BIG-IP product hotfixes, refer to the F5 article K13123.