CVE-2021-23014 Missing authorization in BIG-IP ASM/Advanced WAF

High 8.8 Published 10 May 2021 Updated 3 Aug 2024

Authenticated guest users can upload files to a restricted directory due to missing authorization checks in the REST API.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-23014?

CVE-2021-23014 is a high-severity missing authorization vulnerability in F5 Big-Ip Advanced Web Application Firewall, published on 10 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Weakness: CWE-862

Which versions are affected by CVE-2021-23014?

It affects 2 products.

Products include F5 Big-Ip Advanced Web Application Firewall, F5 Big-Ip Application Security Manager.

How do I fix CVE-2021-23014?

No fix has been published for CVE-2021-23014 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-23014 being exploited?

There is no known exploitation of CVE-2021-23014 in the wild and no public exploit code.

All F5 Big-Ip Advanced Web Application Firewall vulnerabilities

Sources

Also known as GHSA-f4w3-762f-pwx9.