F5 BIG-IP CVE-2022-1388 actively exploited in wild
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Critical unauthenticated F5 BIG-IP vulnerability enabling remote code execution is actively being exploited with public POC available.
CVE-2022-1388 is a critical authentication bypass in F5 BIG-IP's iControl REST interface affecting versions 16.1.x (prior to 16.1.2.2), 15.1.x (prior to 15.1.5.1), 14.1.x (prior to 14.1.4.6), 13.1.x (prior to 13.1.5), and end-of-life 12.1.x and 11.6.x versions. An unauthenticated attacker with network access to the management port or self-IP addresses can exploit this vulnerability to execute arbitrary system commands, create or delete files, or disable services. F5 released patches on May 4, 2022, but public proof-of-concept exploits followed, lowering the barrier to exploitation. As of May 2022, CISA confirmed active exploitation in the wild and assessed widespread compromise of unpatched devices was likely, particularly those with publicly exposed management interfaces. Defenders should assume compromise for any unpatched device with internet-facing management access and hunt for malicious activity. Immediate patching is critical; if patching is impossible, implement temporary workarounds including blocking iControl REST access via self-IP and management interface, and modify httpd configuration per F5 guidance.
Mentioned in this report
Detection guidance
F5 BIG-IP iControl REST util/bash Request (CVE-2022-1388 Exploitation)
Detects POST requests to the iControl REST /mgmt/tm/util/bash endpoint, the command-execution primitive abused after the CVE-2022-1388 authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: F5 BIG-IP iControl REST util/bash Request (CVE-2022-1388 Exploitation)
description: Detects POST requests to the iControl REST /mgmt/tm/util/bash endpoint
on BIG-IP management/self-IP interfaces. This endpoint runs arbitrary shell commands
and is the primitive used after the CVE-2022-1388 authentication bypass. Generalises
on the endpoint and method, not on specific commands, source IPs or payloads.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains: /mgmt/tm/util/bash
condition: selection
falsepositives:
- Administrators or automation intentionally running shell commands through the iControl
REST util/bash API from a trusted management host
level: high
id: c758e69c-6aac-5e04-8334-d3a9286ea9ba
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138a
Suspicious Shell Spawned by Java (restjavad) on F5 BIG-IP
Detects a bash shell spawned by a java parent (restjavad/iControl REST) running download, reverse-shell, or account-manipulation commands, as seen after CVE-2022-1388 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Spawned by Java (restjavad) on F5 BIG-IP
description: Detects bash launched with -c by a java parent process (iControl REST
service restjavad on BIG-IP) whose command line contains download, reverse shell,
payload staging or tmsh user-creation patterns. Post-exploitation behaviour of CVE-2022-1388
command execution, not specific to one payload.
tags:
- attack.execution
- attack.t1059.004
- attack.privilege-escalation
- attack.t1548
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
Image|endswith:
- /bash
- /sh
CommandLine|contains: ' -c '
selection_cmd:
CommandLine|contains:
- 'curl '
- 'wget '
- /dev/tcp/
- mkfifo
- bash -i
- chmod +x
- base64 -d
- nc -e
- create auth user
- authorized_keys
condition: selection_parent and selection_cmd
falsepositives:
- Java-based management or deployment agents on the host legitimately invoking curl
or wget through a shell wrapper
- Administrators using iControl REST automation to run maintenance scripts
level: medium
id: d0d0df10-a867-5397-a05f-ead6ed8b4df0
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,572 reports from 145 sources, 596 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs