CVE-2023-46747: Critical Authentication Bypass Vulnerability in F5 BIG-IP

A critical authentication bypass vulnerability in F5’s BIG-IP could allow remote, unauthenticated attackers to execute system commands. Organizations are encouraged to apply patches as soon as possible.

Background

On October 25, Praetorian published a blog post warning of a newly discovered vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to execute code on affected devices. Their initial blog post indicated that BIG-IP instances that exposed the Traffic Management User Interface (TMUI) were at risk and that exploitation of the vulnerability would allow “full administrative privileges.” At the time their initial blog post was released, no CVE identifier was provided, however, Praetorian noted that additional technical details would be released once a patch was available from F5.

On October 26, F5 published a security advisory for the vulnerability along with a CVE identifier, CVE-2023-46747, while Praetorian published another blog post describing how they identified the vulnerability with some limited technical details. Praetorian notes that additional details will be released at a later date to ensure affected users have adequate time to patch.

Analysis

CVE-2023-46747 is a critical severity authentication bypass vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to achieve remote code execution (RCE). The vulnerability impacts the BIG-IP Configuration utility, also known as the TMUI, wherein arbitrary requests can bypass authentication. The vulnerability received a CVSSv3 score of 9.8.

According to the blog post by researchers at Praetorian, a request smuggling vulnerability, CVE-2022-26377 affecting Apache HTTP Server, was acknowledged by F5 in a KB article, but never fixed. This gave the researchers an avenue for exploitation and in their blog post, they detailed that an Apache JServ Protocol (AJP) smuggling bug was leveraged as part of the device compromise to bypass authentication and achieve code execution as the root user. While their blog post contained limited technical details as of October 27, additional details are expected to be released at a later date, once organizations have had adequate time to apply the patch.

Historical exploitation of BIG-IP

On June 30, 2020, F5 released an advisory and patches to address a critical RCE, CVE-2020-5902, affecting the TMUI on BIG-IP instances. Within days, reports of in the wild exploitation was observed and several proof-of-concept (PoC) scripts became publicly available.

CVE-2020-5902 was quickly adopted by threat actors and nation state groups, earning a spot in the top five vulnerabilities in our 2020 Threat Landscape Retrospective report and an honorable mention in our 2022 Threat Landscape Report due to continued exploitation of the vulnerability. F5 later updated its advisory to say “If your BIG-IP system has TMUI exposed to the Internet and it does not have a fixed version of software installed, there is a high probability that it has been compromised and you should follow your internal incident response procedures.” Less than a month after the advisory was published, the Cybersecurity and Infrastructure Security Agency (CISA) released guidance for CVE-2020-5902, stressing that the “risk posed by the vulnerability is critical.”

In May 2022, CVE-2022-1388, another authentication bypass vulnerability affecting F5 BIG-IP was patched. Soon after the release of the security advisory, PoC scripts for CVE-2022-1388 became publicly available and in-the-wild exploitation was observed.

CVE-2023-46748: F5 confirms exploit chain involving an additional zero-day

As part of the hotfix releases to address CVE-2023-46747, F5 also patched another vulnerability affecting TMUI. CVE-2023-46748 is a high severity, authenticated SQL injection vulnerability with a CVSSv3 score of 8.8. This SQL injection vulnerability was credited to an anonymous researcher.

Previously, this blog post stated that CVE-2023-46748 did not appear to be related to CVE-2023-46747. However, F5 updated its advisories for both CVEs on October 30 to highlight that threat actors are exploiting CVE-2023-46747 together with CVE-2023-46748 as part of an exploit chain in observed attacks in the wild.

Proof of concept

As of October 27, no PoC code has been released for CVE-2023-46747. However, given the prompt exploitation of past vulnerabilities affecting BIG-IP and the release of multiple PoCs by researchers, we anticipate exploit code will be available soon.

On October 29, a PoC script was added to the Nuclei project's GitHub repository. Within 24 hours, several additional PoC scripts were found on GitHub with similar requests and HTTP POST request examples for exploitation of CVE-2023-46747.

Solution

While patching is the recommended course of action, F5 has also provided some mitigation guidance if patching cannot be performed immediately. We recommend reviewing F5 article K000137353 for the recommended mitigation steps and warnings.

F5 warns that the mitigation script they provided must NOT be used on BIG-IP versions prior to 14.1.0. In addition, the mitigation script should not be used if the FIPS 140-2 Compliant Mode license is in use, as the mitigation script can cause FIPS integrity checks to fail.

The following table lists the affected and fixed branch versions of BIG-IP:

Identifying affected systems

A list of Tenable plugins to identify affected systems can be located on the individual CVE pages for CVE-2023-46747 and CVE-2023-46748. These links will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.

Customers that want to identify F5 BIG-IP instances can utilize our asset detection Plugin ID 76940.

Get more information

• F5 Security Advisory: K000137353: BIG-IP Configuration utility unauthenticated remote code execution vulnerability CVE-2023-46747
• F5 Security Advisory: K000137365: BIG-IP Configuration utility authenticated SQL injection vulnerability CVE-2023-46748
• Praetorian Blog: Refresh: Compromising F5 BIG-IP With Request Smuggling | CVE-2023-46747
• Praetorian Blog: Technical Advisory: F5 BIG-IP Unauthenticated RCE Vulnerability, CVE-2023-46747
• Tenable Blog: CVE-2020-5902: Critical Vulnerability in F5 BIG-IP Traffic Management User Interface (TMUI) Actively Exploited
• Tenable Blog: CVE-2022-1388: Authentication Bypass in F5 BIG-IP

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.