CVE-2021-23008 : Security Advisory and Response

This article provides an overview of CVE-2021-23008, a vulnerability impacting BIG-IP APM that allows for unauthorized access via bypassing the AD authentication.

Understanding CVE-2021-23008

This section details the impact, technical aspects, and mitigation strategies related to CVE-2021-23008.

What is CVE-2021-23008?

CVE-2021-23008 affects BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x. It enables unauthorized access by bypassing AD authentication through spoofed AS-REP responses.

The Impact of CVE-2021-23008

The vulnerability allows attackers to bypass AD authentication on the affected versions of BIG-IP APM, potentially leading to unauthorized access to Active Directory resources.

Technical Details of CVE-2021-23008

This section delves deeper into the vulnerability's description, affected systems, and exploitation methods.

Vulnerability Description

The flaw in BIG-IP APM allows for the bypassing of AD authentication by sending spoofed AS-REP responses over compromised KDC connections or from compromised AD servers.

Affected Systems and Versions

BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x are vulnerable to this exploit.

Exploitation Mechanism

The vulnerability can be exploited by sending spoofed AS-REP responses over hijacked KDC connections or from AD servers compromised by attackers.

Mitigation and Prevention

Learn about the immediate steps to take and long-term security practices to protect systems from CVE-2021-23008.

Immediate Steps to Take

Ensure you update BIG-IP APM to the patched versions - 15.1.3, 14.1.4, 13.1.4, 12.1.6, and any subsequent releases to mitigate the risk.

Long-Term Security Practices

Implement network segmentation, strong authentication mechanisms, and monitoring solutions to enhance the security posture of your infrastructure.

Patching and Updates

Regularly apply security patches and updates provided by F5 to ensure your systems are protected against known vulnerabilities and exploits.