cancel
Showing results for 
Search instead for 
Did you mean: 

cve-2022-22536 protections from F5?

Jim_M
Cirrus
Cirrus

Does F5 ASM offer any protection against cve-2022-22536? This is a SAP Netweaver vulnerability.

I havent seen anything posted on AskF5

1 ACCEPTED SOLUTION

JRahm
Community Manager
Community Manager
4 REPLIES 4

Pedro_Roure
Cirrus
Cirrus

 

Give a look at the KB below. It contains a link with all attack signatures provided by F5.

https://support.f5.com/csp/article/K62525205

Or you can look for directly in the device by using this other KB:

https://support.f5.com/csp/article/K45558510

Hi @Jim_M,

The descripton for CVE-2022-22536 states: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

There are two attack signatures that will protect against request smuggling:
* Signature ID: 200018085, Request Smuggling Attempt (CR Before CL Header)
* Signature ID: 200018086, Request Smuggling Attempt (SP/CL after Header)

I didn't see anything in the Threat Campaign signatures yet.

KR
Daniel

Short update:

F5 has added a Bot Signature for Onapsis ICMAD tool which is known as a tool that attempts to exploit SAP products that are vulnerable to request smuggling and request concatenation.

With Advanced WAF and an active Threat Campaigns subscription Bot Signatures can be updated dynamically. Otherwise Bot Signature Updates come with every major BIG-IP release. See K82512024: Managing BIG-IP ASM Live Updates (14.1.x and later)

Bot Signatures: Class of signatures that identify legitimate or malicious web robots by looking for specific patterns in the headers of incoming HTTP requests. With the release of BIG-IP 14.1.0, this feature requires a separate license. Bot signature updates are part of the Threat Campaigns subscription-based service license. Without a Threat Campaigns license, bot signatures cannot be updated using manual or automatic updates; however, you can still add custom bot signatures.

 

EDIT: Now there is also an Attack Signature that was added on 15. February 2022. 
Signature ID: 200020213
Name: SAP NetWeaver request smuggling

JRahm
Community Manager
Community Manager

AskF5 has posted a solution: K11248009