F5 BIG-IP iControl Rest API Command Execution - Webserver

 1title: F5 BIG-IP iControl Rest API Command Execution - Webserver
 2id: 85254a62-22be-4239-b79c-2ec17e566c37
 3related:
 4    - id: b59c98c6-95e8-4d65-93ee-f594dfb96b17
 5      type: similar
 6status: test
 7description: Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP
 8references:
 9    - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
10    - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
11    - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516
12author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
13date: 2023-11-08
14tags:
15    - attack.execution
16    - attack.t1190
17logsource:
18    category: webserver
19detection:
20    selection:
21        cs-method: 'POST'
22        cs-uri-query|endswith: '/mgmt/tm/util/bash'
23    condition: selection
24falsepositives:
25    - Legitimate usage of the BIG IP REST API to execute command for administration purposes
26level: medium

References

• f5.bigip.tm.util — F5 Python SDK 3.0.20 documentation

  Update the configuration of the resource on the BIG-IP®. This method uses HTTP PUT alter the resource state on the BIG-IP®. The attributes of the instance will be packaged as a dictionary. That dic...

  
  Read More

• iControlREST (11.5) - execute bash command | DevCentral

  I've been playing with iControlREST recently, and trying to port some old iControl scripts over. Most of them work nicely, but I've got one that requires...

  
  Read More

• Running BASH commands via REST API | DevCentral

  I am trying to run bash commands via the REST API but am getting an error. When trying to use the following syntax I am getting a 403 running with Admin...

  
  Read More

Related rules

• CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)
• CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)
• Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution
• Atlassian Confluence CVE-2022-26134
• DNS RCE CVE-2020-1350