Privilege Escalation in F5 BIG-IP Products

CVE-2015-3628

Summary

The vulnerability in the iControl API of F5 BIG-IP products allows remote authenticated users with the 'Resource Administrator' role to exploit specially crafted iCall scripts or handlers. This can be achieved through a manipulated SOAP request to iControl/iControlPortal.cgi, potentially granting unauthorized access and elevated privileges. Affected versions include various releases of BIG-IP LTM, AFM, APM, and other F5 products, making timely updates and security patches crucial for users.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2015-3628
Created by Rapid7

References