F5 BIG-IP SAML Spoofing Vulnerability

The F5 BIG-IP system is a high-performance web server and application delivery controller used by many organizations for secure and scalable internet traffic management. When configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, the BIG-IP system can be exploited to increase memory resource utilization through undisclosed requests.

You're affected if you use F5 BIG-IP versions 11.6.0 to 12.1.4 and later software releases that have reached End of Technical Support (EoTS). Check with: bigip-config show | grep saml or bigip-config show | grep single-logout

Note: This vulnerability is specific to F5 BIG-IP systems, not other web servers like Apache HTTPD.

1. Upgrade to a version that has reached End of Technical Support (EoTS) or later.
2. Immediate mitigations:
3. Restrict network access to your BIG-IP instance (firewall it from the public internet)
4. Audit admin account activity for suspicious access patterns
5. Monitor for unauthorized token creation

• Vendor Advisory