F5 patches BIG-IP APM flaw exploited for RCE

F5 said the flaw was present only when BIG-IP Access Policy Manager was configured as an OAuth authorisation server on a virtual server that also held the access policy. It said specially crafted traffic sent to that server could lead to remote code execution, and it described the bug as a heap-based buffer overflow.

The company rated the issue 9.8 under CVSS v3.1 and 9.3 under CVSS v4.0. It also said limiting access to the management interface did not remove the exposure, and that Appliance mode systems were also vulnerable.

CISA added the flaw to its KEV list on 22 September and ordered federal civilian agencies to apply mitigations by 25 September under a June directive. F5 later revised its CVE record at 00:45 UTC on 23 September to say the condition was limited to the authorisation-server role, while earlier CISA and CERT-EU notices described the setup more broadly. F5 also said it had not assessed versions that had reached end of technical support, so their status was unknown.

F5 said the vendor fix was an engineering hotfix, and that customers could ask support for an iRule workaround if they could not patch at once. F5 and CERT-EU listed checks for repeated failed UserInfo requests, rising failure counters, suspicious audit entries and TMM core files, and said repeated OAuth failures followed by suspicious commands and a TMM SIGABRT should prompt human review.