1## autogenerated on 2025-04-23 16:03:44
2name: crowdsecurity/vpatch-CVE-2022-1388
3description: 'Detects F5 BIG-IP iControl REST authentication bypass and RCE via crafted POST to /mgmt/tm/util/bash with X-F5-Auth-Token header.'
4rules:
5  - and:
6      - zones:
7          - URI
8        transform:
9          - lowercase
10        match:
11          type: contains
12          value: /mgmt/tm/util/bash
13      - zones:
14          - HEADERS_NAMES
15        transform:
16          - lowercase
17        match:
18          type: contains
19          value: x-f5-auth-token
20      - zones:
21          - HEADERS_NAMES
22        transform:
23          - lowercase
24        match:
25          type: contains
26          value: authorization
27labels:
28  type: exploit
29  service: http
30  confidence: 3
31  spoofable: 0
32  behavior: 'http:exploit'
33  label: 'F5 BIG-IP iControl REST - Authentication Bypass'
34  classification:
35    - cve.CVE-2022-1388
36    - attack.T1190
37    - cwe.CWE-306
38