Forum Discussion

chanzk's avatar
chanzk
Icon for Altostratus rankAltostratus
Sep 14, 2023

F5 Rules for AWS WAF - CVE-2021-22118 & CVE-2016-1000027

Hello,

We're checking in the AWS marketplace for the F5 Rules for AWS WAF - Common Vulnerabilities and Exposures (CVE) Rules and want to check if the following CVEs are covered by this rule set?

  • CVE-2021-22118: Local Privilege Escalation within Spring Webflux Multipart Request Handling
  • CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data.

Thanks.

AWS
cloud
cve
F5 Rules for AWS WAF
security
waf
  • Joel_Cohen's avatar
    Joel_Cohen
    Sep 19, 2023

    Hi chanzk ,

    Unlike the full blown WAF security solutions, F5 rules on AWS WAF are limited in total capacity, limiting the types of CVEs we can offer protection against. Normally, F5 rules include protection against CVEs that are common among customers. CVE-2016-1000027 may affect only few, therefore it wasn't included yet. We will add it in our next updates.

    CVE-2021-22118 is a local vulnerability, not a network vulnerability. So less relevant for a WAF.

    Thanks.

  • Joel_Cohen's avatar
    Joel_Cohen
    Icon for Employee rankEmployee
    Sep 19, 2023

    Hi chanzk ,

    Unlike the full blown WAF security solutions, F5 rules on AWS WAF are limited in total capacity, limiting the types of CVEs we can offer protection against. Normally, F5 rules include protection against CVEs that are common among customers. CVE-2016-1000027 may affect only few, therefore it wasn't included yet. We will add it in our next updates.

    CVE-2021-22118 is a local vulnerability, not a network vulnerability. So less relevant for a WAF.

    Thanks.

    • chanzk's avatar
      chanzk
      Icon for Altostratus rankAltostratus
      Sep 20, 2023

      Hi Joel_Cohen ,

      Thanks very much of the information. That is useful. May I know the schedule of next updates that invlude CVE-2016-1000027?

      Regards,

      • chanzk's avatar
        chanzk
        Icon for Altostratus rankAltostratus
        Sep 21, 2023

        Hi Joel_Cohen ,

        It would be helpful if I could know the schedule of next updates that include CVE-2016-1000027. Thanks.

        Regards,

    • chanzk's avatar
      chanzk
      Icon for Altostratus rankAltostratus
      Sep 18, 2023

      Hi whisperer ,

      Thanks for the reply. As I mentioned, I am using AWS marketplace for the F5 Rules for AWS WAF - Common Vulnerabilities and Exposures (CVE) Rules. Therefore I do not have access to the BIG-IP ASM/AdvWAF Configuration Utility. Does it mean that it is impossible to check what CVEs are included when subscripting F5 rules from AWS marketplace?

      Thanks.

  • whisperer's avatar
    whisperer
    Icon for MVP rankMVP
    Sep 18, 2023

    I really cannot think of a way to a) programmatically via CLI obtain this information from the product, b) nor am I aware of any online based index or search tool for figuring out what version/signature release covers certain CVEs.

    If I need a quick answer, I would just run an F5 VE instance on VMware, same BIGIP code and attack signature version, and reference it that way.

    I would be very interested in knowing of a better way of doing this. Have you tried to contact an F5 sales engineer or product support?

  • buulam's avatar
    buulam
    Icon for Admin rankAdmin
    Sep 18, 2023

    Hi chanzk , I've asked the Product Manager for the F5 Rules for AWS WAF to review.

    Will let you know what the response is. Thank you

      • ambrosetse's avatar
        ambrosetse
        Icon for Altostratus rankAltostratus
        Oct 09, 2023

        Hi Joel_Cohen 

        I would like to know if the current F5 rules for AWS WAF cover for the following vulnerabilities?
        CVE-2022-22968, CVE-2022-22976, CVE-2022-22970, CVE-2022-22950, CVE-2023-20861 and CVE-2023-20863
        If not, will they include at the future release?

        Thanks

         

        Ambrose