F5 BIG-IP iControl Exploit Attempt - CVE-2022-41622

The F5 BIG-IP Local Traffic Manager appliance can leverage the iControl SOAP API for system management. An iControl endpoint is vulnerable to accepting malicious SOAP requests through cross-site request forgery (CRSF). To exploit this vulnerability, an attacker locates the IP address or hostname of an iControl endpoint and identifies an administrator with access to that endpoint. Next, the attacker lures the administrator to a malicious website (1). The website tricks the administrator web browser into sending an HTTP POST request with a malicious SOAP payload to the iControl endpoint (2). The iControl endpoint trusts the POST request because the request was sent by an authenticated user and runs the malicious payload.