CVE-2023-46747: Critical Authentication Bypass Vulnerability in F5 BIG-IP
2023-10-28 00:43:49 Author: www.tenable.com(查看原文) 阅读量:85 收藏

A critical authentication bypass vulnerability in F5’s BIG-IP could allow remote, unauthenticated attackers to execute system commands. Organizations are encouraged to apply patches as soon as possible.

Background

On October 25, Praetorian published a blog post warning of a newly discovered vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to execute code on affected devices. Their initial blog post indicated that BIG-IP instances that exposed the Traffic Management User Interface (TMUI) were at risk and that exploitation of the vulnerability would allow “full administrative privileges.” At the time their initial blog post was released, no CVE identifier was provided, however, Praetorian noted that additional technical details would be released once a patch was available from F5.

On October 26, F5 published a security advisory for the vulnerability along with a CVE identifier, CVE-2023-46747, while Praetorian published another blog post describing how they identified the vulnerability with some limited technical details. Praetorian notes that additional details will be released at a later date to ensure affected users have adequate time to patch.

Analysis

CVE-2023-46747 is a critical severity authentication bypass vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to achieve remote code execution (RCE). The vulnerability impacts the BIG-IP Configuration utility, also known as the TMUI, wherein arbitrary requests can bypass authentication. The vulnerability received a CVSSv3 score of 9.8.

According to the blog post by researchers at Praetorian, a request smuggling vulnerability, CVE-2022-26377 affecting Apache HTTP Server, was acknowledged by F5 in a KB article, but never fixed. This gave the researchers an avenue for exploitation and in their blog post, they detailed that an Apache JServ Protocol (AJP) smuggling bug was leveraged as part of the device compromise to bypass authentication and achieve code execution as the root user. While their blog post contained limited technical details as of October 27, additional details are expected to be released at a later date, once organizations have had adequate time to apply the patch.

Historical exploitation of BIG-IP

On June 30, 2020, F5 released an advisory and patches to address a critical RCE, CVE-2020-5902, affecting the TMUI on BIG-IP instances. Within days, reports of in the wild exploitation was observed and several proof-of-concept (PoC) scripts became publicly available.

CVE-2020-5902 was quickly adopted by threat actors and nation state groups, earning a spot in the top five vulnerabilities in our 2020 Threat Landscape Retrospective report and an honorable mention in our 2022 Threat Landscape Report due to continued exploitation of the vulnerability. F5 later updated its advisory to say “If your BIG-IP system has TMUI exposed to the Internet and it does not have a fixed version of software installed, there is a high probability that it has been compromised and you should follow your internal incident response procedures.” Less than a month after the advisory was published, the Cybersecurity and Infrastructure Security Agency (CISA) released guidance for CVE-2020-5902, stressing that the “risk posed by the vulnerability is critical.”

In May 2022, CVE-2022-1388, another authentication bypass vulnerability affecting F5 BIG-IP was patched. Soon after the release of the security advisory, PoC scripts for CVE-2022-1388 became publicly available and in-the-wild exploitation was observed.

Proof of concept

As of October 27, no PoC code has been released for CVE-2023-46747. However, given the prompt exploitation of past vulnerabilities affecting BIG-IP and the release of multiple PoCs by researchers, we anticipate exploit code will be available soon.

Solution

While patching is the recommended course of action, F5 has also provided some mitigation guidance if patching cannot be performed immediately. We recommend reviewing F5 article K000137353 for the recommended mitigation steps and warnings.

F5 warns that the mitigation script they provided must NOT be used on BIG-IP versions prior to 14.1.0. In addition, the mitigation script should not be used if the FIPS 140-2 Compliant Mode license is in use, as the mitigation script can cause FIPS integrity checks to fail.

The following table lists the affected and fixed branch versions of BIG-IP:

BranchAffection VersionsFixed Version
13.x13.1.0 - 13.1.513.1.5.1 + Hotfix-BIGIP-13.1.5.1.0.20.2-ENG
14.x14.1.0 - 14.1.514.1.5.6 + Hotfix-BIGIP-14.1.5.6.0.10.6-ENG
15.x15.1.0 - 15.1.1015.1.10.2 + Hotfix-BIGIP-15.1.10.2.0.44.2-ENG
16.x16.1.0 - 16.1.416.1.4.1 + Hotfix-BIGIP-16.1.4.1.0.50.5-ENG
17.x17.1.017.1.0.3 + Hotfix-BIGIP-17.1.0.3.0.75.4-ENG

Identifying affected systems

A list of Tenable plugins to identify affected systems can be located on the individual CVE page for CVE-2023-46747. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.

Customers that want to identify F5 BIG-IP instances can utilize our asset detection Plugin ID 76940.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

Scott Caveza

Scott Caveza

Scott joined Tenable in 2012 as a Research Engineer on the Nessus Plugins team. Over the years, he has written hundreds of plugins for Nessus, and reviewed code for even more from his time being a team lead and manager of the Plugins team. Previously leading the Security Response team and the Zero Day Research team, Scott is currently a member of the Security Response team, helping the research organization respond to the latest threats. He has over a decade of experience in the industry with previous work in the Security Operations Center (SOC) for a major domain registrar and web hosting provider. Scott is a current CISSP and actively maintains his GIAC GWAPT Web Application Penetration Tester certification.

Interests outside of work: Scott enjoys spending time with his family, camping, fishing and being outdoors. He also enjoys finding ways to break web applications and home renovation projects.

Related Articles

  • Exposure Management

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.

Tenable Vulnerability Management

Formerly Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Formerly Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Thank You

Thank you for your interest in Tenable.io. A representative will be in touch soon.

Try Tenable Nessus Professional Free

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
Now Available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro Trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable.io

BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Thank You

Thank you for your interest in Tenable.io. A representative will be in touch soon.

Try Tenable Web App Scanning

Formerly Tenable.io Web Application Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.

Buy Tenable Web App Scanning

Formerly Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

Try Tenable Lumin

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.

Buy Tenable Lumin

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

Thank You

Thank you for your interest in Tenable Lumin. A representative will be in touch soon.

Request a demo of Tenable Security Center

Formerly Tenable.sc

Please fill out this form with your contact information.

A sales representative will contact you shortly to schedule a demo.

* Field is required

Request a demo of Tenable OT Security

Formerly Tenable.ot

Get the Operational Technology Security You Need.

Reduce the Risk You Don’t.

Request a demo of Tenable Identity Exposure

Formerly Tenable.ad

Continuously detect and respond to Active Directory attacks. No agents. No privileges.

On-prem and in the cloud.

Request a Demo of Tenable Cloud Security

Exceptional unified cloud security awaits you!

We’ll show you exactly how Tenable Cloud Security helps you deliver multi-cloud asset discovery, prioritized risk assessments and automated compliance/audit reports.

See
Tenable One
In Action

Exposure management for the modern attack surface.

See Tenable Attack Surface Management In Action

Formerly Tenable.asm

Know the exposure of every asset on any platform.

Thank You

Thank you for your interest in Tenable Attack Surface Management. A representative will be in touch soon.

Try Tenable Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Try Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.


文章来源: https://www.tenable.com/blog/cve-2023-46747-critical-authentication-bypass-vulnerability-in-f5-big-ip
如有侵权请联系:admin#unsafe.sh