automatic module_metadata_base.json update

Author: msjenkins-r7

db/modules_metadata_base.json

@@ -56515,6 +56515,70 @@
     },
     "needs_cleanup": null
   },
+  "exploit_linux/http/f5_icontrol_rest_ssrf_rce": {
+    "name": "F5 iControl REST Unauthenticated SSRF Token Generation RCE",
+    "fullname": "exploit/linux/http/f5_icontrol_rest_ssrf_rce",
+    "aliases": [
+
+    ],
+    "rank": 600,
+    "disclosure_date": "2021-03-10",
+    "type": "exploit",
+    "author": [
+      "wvu <wvu@metasploit.com>",
+      "Rich Warren"
+    ],
+    "description": "This module exploits a pre-auth SSRF in the F5 iControl REST API's\n          /mgmt/shared/authn/login endpoint to generate an X-F5-Auth-Token that\n          can be used to execute root commands on an affected BIG-IP or BIG-IQ\n          device. This vulnerability is known as CVE-2021-22986.\n\n          CVE-2021-22986 affects the following BIG-IP versions:\n\n          * 12.1.0 - 12.1.5\n          * 13.1.0 - 13.1.3\n          * 14.1.0 - 14.1.3\n          * 15.1.0 - 15.1.2\n          * 16.0.0 - 16.0.1\n\n          And the following BIG-IQ versions:\n\n          * 6.0.0 - 6.1.0\n          * 7.0.0\n          * 7.1.0\n\n          Tested against BIG-IP Virtual Edition 16.0.1 in VMware Fusion.",
+    "references": [
+      "CVE-2021-22986",
+      "URL-https://support.f5.com/csp/article/K03009991",
+      "URL-https://attackerkb.com/assessments/f6b19d24-b24e-4abd-98cf-2988d7424311",
+      "URL-https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/"
+    ],
+    "platform": "Linux,Unix",
+    "arch": "cmd, x86, x64",
+    "rport": 443,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Unix Command",
+      "Linux Dropper"
+    ],
+    "mod_time": "2021-03-22 23:54:38 +0000",
+    "path": "/modules/exploits/linux/http/f5_icontrol_rest_ssrf_rce.rb",
+    "is_install_path": true,
+    "ref_name": "linux/http/f5_icontrol_rest_ssrf_rce",
+    "check": true,
+    "post_auth": true,
+    "default_credential": true,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs",
+        "account-lockouts",
+        "artifacts-on-disk"
+      ]
+    },
+    "needs_cleanup": null
+  },
   "exploit_linux/http/foreman_openstack_satellite_code_exec": {
     "name": "Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection",
     "fullname": "exploit/linux/http/foreman_openstack_satellite_code_exec",