Undisclosed Requests May Bypass Configuration Utility Authentication in F5 BIG-IP Systems, Allowing Attackers to Execute Arbitrary System Commands

CVE-2023-46747
9.8CRITICAL

Key Information

Vendor
F5
Status
BIG-IP
Vendor
CVE Published:
26 October 2023

Badges

😄 Trended👾 Exploit Exists🔴 Public PoC🟣 EPSS 97%📰 News Worthy

Summary

The vulnerability CVE-2023-46747 in F5 BIG-IP systems allows for the bypass of configuration utility authentication, enabling attackers to execute arbitrary system commands. This critical-severity unauthenticated remote code execution flaw affects several versions of the BIG-IP security appliances, with a CVSS v3 score of 9.8 out of 10. Threat actors have been observed using this vulnerability to exploit CVE-2023-46748, a related authenticated SQL injection vulnerability. This exploitation poses a control plane issue only and does not expose the data plane. The security firm Mandiant has attributed this critical-severity vulnerability to a China-linked threat cluster, linking it to a series of aggressive cyberattack campaigns targeting various organizations in Southeast Asia and the US. These attacks involve the delivery of custom malware capable of delivering additional backdoors on compromised Linux hosts, emphasizing the significance and potential impact of the vulnerability. This underscores the urgency of applying the released patches and implementing necessary mitigations to protect against potential exploitation.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-46747 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

BIG-IP < 17.1.0

BIG-IP < 16.1.0

BIG-IP < 15.1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-46747-RCE
Created by W01fh4cker

test_cve-2023-46747
Created by nvansluis

Mitigate-CVE-2023-46747
Created by maniak-academy

News Articles

favicon imageDuo Security

F5 Patches Remote Code Execution Bug in BIG-IP

The critical-severity, unauthenticated remote code execution flaw exists in several versions of the F5 BIG-IP security appliances.

6 months ago

favicon imageThe Hacker News

China-Linked Group Breaches Networks via Connectwise, F5 Software Flaws

China-linked threat group aggressively exploits software flaws in Connectwise ScreenConnect & F5 BIG-IP.

6 months ago

favicon imageMandiant

Bringing Access Back — Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect

During the course of an intrusion investigation in late October 2023, Mandiant observed novel N-day exploitation of CVE-2023-46747 affecting F5 BIG-IP Traffic Management User Interface. Additionally, in...

6 months ago

EPSS Score

97% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability started trending.

  • 👾

    Exploit exists.

  • First article discovered by The Hacker News

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre DatabaseCISA Database6 Proof of Concept(s)12 News Article(s)

Credit

F5 acknowledges Thomas Hendrickson and Michael Weber of Praetorian Security, Inc. for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.