F5 BIG-IP and BIG-IQ Exploit - CVE-2021-22986

The Control management REST interface in F5 BIG-IP and BIG-IQ devices includes vulnerabilities that can be linked together in an attack chain to achieve RCE. The order of the chained exploits depends on BIG-IP and BIG-IQ configurations. One example of an attack chain begins with a server-side request forgery (SSRF) attack, exploiting an authentication bypass vulnerability that creates an authenticated session with the victim. The attacker can then exploit a command injection vulnerability, CVE-2021-22986, by sending an HTTP POST request with an arbitrary, malicious command to a restricted management REST API endpoint (such as mgmt/tm/util/bash). The victim responds with a confirmation that the command was processed.