K52510511 : Advanced WAF/ASM buffer-overflow vulnerability CVE-2021-22992

Security Advisory Description

A malicious HTTP response to an Advanced WAF/ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution (RCE), leading to complete system compromise. (CVE-2021-22992)

Impact

A sophisticated attacker must have control over the back-end web servers (pool members) or the ability to manipulate the server-side HTTP responses to the virtual server to exploit this vulnerability. With this level of back-end control, the attacker may cause the BIG-IP Advanced WAF/ASM system to experience a denial-of-service (DoS). In the worst case, the attacker may execute arbitrary code on the BIG-IP Advanced WAF/ASM system. This vulnerability can only be exploited through the data plane and cannot be exploited through the control plane. Exploitation can lead to complete system compromise.

Note: If you believe your system may have been compromised, refer to K11438344: Considerations and guidance when you suspect a security compromise on a BIG-IP system.