Blog Post:

CodeGreen Discovers 2nd Zero Day Vulnerability in F5: Privilege Escalation (CVE-2022-28714) Disclosure

Zero Day
11
May 2022

CodeGreen Discovers 2nd Zero Day Vulnerability in F5: Privilege Escalation (CVE-2022-28714) Disclosure

Wednesday, May 11, 2022

A DLL hijacking and  privilege escalation vulnerability exists in the BIG-IP Edge Client Windows Installer. (CVE-2022-28714)

This issue was discovered by CodeGreen Systems Security Analyst and Principal Consultant Raeez Abdulla during a penetration testing engagement with one of our BFSI customers. It is being disclosed in accordance with industry best practices vulnerability disclosure policy and was notified to the F5 Security Incident Response Team on 4th Nov 2021.

F5 Product Development has assigned ID 1067993 (BIG-IP) to this vulnerability. This issue has been classified as CWE-427: Uncontrolled Search Path Element.

‍

Further details of this vulnerability and Vendor acknowledgement to CodeGreen.
https://support.f5.com/csp/article/K54460845

‍

For details on CVE MITRE Reference, please refer to
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28714

‍

Exploitation of CVE-2022-28714 (FIXED on 4th May 2022)

When a VPN application is downloaded and installed from the web portal, after running the installer for the first time, connection requires admin privileges to set up the driver, tunnel etc. During this process, it tries to load DLLs from directories where low privileged users have write access. This is vulnerable to highjacking. A crafted DLL can be placed by an attacker to hijack the execution for elevating the privilege.

‍

Vulnerability Impact

The attacker who already has a foothold in the system, this vulnerability can be used for persistence and privilege escalation.

‍

Affected Platform(s)

Big-IP APM Edge Clients.

‍

Remediating CVE-2022-28714

The client-side fix is now available for download from the vendor link provided above.

‍

Would like to know more?

Contact us at https://www.codegreen.ae/company/support

‍

‍

Disclosure Timeline

Tuesday , 23 Nov 2021

Issue discovered by Raeez Abdulla of CodeGreen Systems

Wednesday, 24 Nov 2021

Initial disclosure to F5-SIRT via Email

Thursday, 23 Dec, 2021

F5 PD assigns Bug ID: Bug 1067993

Wednesday, 04 May 2022

Client and Server side fix is released by F5

Thursday, 05 May 2022

Details on CVE-2022-28714 published

Posted on:

Wednesday, May 11, 2022

in

Zero Day

category

Blog Categories
Read other latest posts

The Blog

Zero Day
May 11, 2022

CodeGreen Discovers 2nd Zero Day Vulnerability in F5: Privilege Escalation (CVE-2022-28714) Disclosure

A DLL hijacking and privilege escalation vulnerability exists in the BIG-IP Edge Client Windows Installer (CVE-2022-28714 acknowledged to CodeGreen), which was discovered by CodeGreen’s security analysts while engaging in a penetration test for one of the largest BFSI customers in the region.

read more
Zero Day
October 22, 2021

CodeGreen Discovers Check Point SSL VPN Zero Day Vulnerability (CVE-2021-30358)

Check Point SSL VPN Mobile Access Portal Agent suffers from a zero day vulnerability where in a hacker can potentially run an arbitrary application that was placed in a specially created location compromising the security. We have discovered this zero day vulnerability while being engaged in a penetration test with one of the largest regional banks.

read more
Zero Day
March 17, 2021

F5 BIG-IP APM Zero Day Vulnerability (CVE-2021-23002) Disclosure

F5 BIG-IP APM versions 11.6.1 - 16.0.1 suffer from a session hijack zero day vulnerability (CVE-2021-23002 acknowledged to CodeGreen), which was discovered by CodeGreen’s security analysts while engaging in a penetration test for one of our BFSI customers. This blog demonstrates this vulnerability along with proof-of-concept (PoC) document we submitted to F5 SIRT.

read more
VAPT
January 14, 2020

Demonstration of Pass-The-Hash Attack

In this blog, Raeez Abdullah our malware analyst talks about and demonstrate how 'pass-the-hash' attack works. 'pass-the-hash' attacks typically exploit the auth protocols and obtain hashes by scraping a system’s active memory. This technique allows attacker to laterally move in the network and gain access to more passwords and password hashes.

read more
Malware Analysis
March 11, 2019

An Anatomy of Emotet Malware: A Live Sample Demonstration

In this post, our malware analyst disects and analyse a live sample of Emotet Malware, one of the most advanced and modular banking Trojan dropper, which can function as a downloader of other banking Trojans or as a ransomeware downloader in some cases. See how this malware exfiltrates data.

read more
VAPT
February 5, 2019

Web Application Penetration Testing and WASC Threat Classification

Web and Mobile application penetration testing is an interesting area to ponder. In spite of many tools, techniques and approaches around; there are few fundamental things we look in to in our penetration testing engagements, which are outlined here.

read more
Privilege Access Management [PAM]
February 20, 2019

Deploying one of the largest PAM projects in the Middle East

Having now implemented, rolled-out and successfully signed off one of the largest PAM deployment in the region comprising of 3500 Servers and Appications, I can now summarise some of the biggest challenges in a large PAM deployment of this size.

read more
View all posts