A critical authentication bypass vulnerability in F5’s BIG-IP could allow remote, unauthenticated attackers to execute system commands. Organizations are encouraged to apply patches as soon as possible.
On October 25, Praetorian published a blog post warning of a newly discovered vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to execute code on affected devices. Their initial blog post indicated that BIG-IP instances that exposed the Traffic Management User Interface (TMUI) were at risk and that exploitation of the vulnerability would allow “full administrative privileges.” At the time their initial blog post was released, no CVE identifier was provided, however, Praetorian noted that additional technical details would be released once a patch was available from F5.
On October 26, F5 published a security advisory for the vulnerability along with a CVE identifier, CVE-2023-46747, while Praetorian published another blog post describing how they identified the vulnerability with some limited technical details. Praetorian notes that additional details will be released at a later date to ensure affected users have adequate time to patch.
CVE-2023-46747 is a critical severity authentication bypass vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to achieve remote code execution (RCE). The vulnerability impacts the BIG-IP Configuration utility, also known as the TMUI, wherein arbitrary requests can bypass authentication. The vulnerability received a CVSSv3 score of 9.8.
According to the blog post by researchers at Praetorian, a request smuggling vulnerability, CVE-2022-26377 affecting Apache HTTP Server, was acknowledged by F5 in a KB article, but never fixed. This gave the researchers an avenue for exploitation and in their blog post, they detailed that an Apache JServ Protocol (AJP) smuggling bug was leveraged as part of the device compromise to bypass authentication and achieve code execution as the root user. While their blog post contained limited technical details as of October 27, additional details are expected to be released at a later date, once organizations have had adequate time to apply the patch.
Historical exploitation of BIG-IP
On June 30, 2020, F5 released an advisory and patches to address a critical RCE, CVE-2020-5902, affecting the TMUI on BIG-IP instances. Within days, reports of in the wild exploitation was observed and several proof-of-concept (PoC) scripts became publicly available.
CVE-2020-5902 was quickly adopted by threat actors and nation state groups, earning a spot in the top five vulnerabilities in our 2020 Threat Landscape Retrospective report and an honorable mention in our 2022 Threat Landscape Report due to continued exploitation of the vulnerability. F5 later updated its advisory to say “If your BIG-IP system has TMUI exposed to the Internet and it does not have a fixed version of software installed, there is a high probability that it has been compromised and you should follow your internal incident response procedures.” Less than a month after the advisory was published, the Cybersecurity and Infrastructure Security Agency (CISA) released guidance for CVE-2020-5902, stressing that the “risk posed by the vulnerability is critical.”
In May 2022, CVE-2022-1388, another authentication bypass vulnerability affecting F5 BIG-IP was patched. Soon after the release of the security advisory, PoC scripts for CVE-2022-1388 became publicly available and in-the-wild exploitation was observed.
As of October 27, no PoC code has been released for CVE-2023-46747. However, given the prompt exploitation of past vulnerabilities affecting BIG-IP and the release of multiple PoCs by researchers, we anticipate exploit code will be available soon.
While patching is the recommended course of action, F5 has also provided some mitigation guidance if patching cannot be performed immediately. We recommend reviewing F5 article K000137353 for the recommended mitigation steps and warnings.
F5 warns that the mitigation script they provided must NOT be used on BIG-IP versions prior to 14.1.0. In addition, the mitigation script should not be used if the FIPS 140-2 Compliant Mode license is in use, as the mitigation script can cause FIPS integrity checks to fail.
The following table lists the affected and fixed branch versions of BIG-IP:
Branch | Affection Versions | Fixed Version |
---|---|---|
13.x | 13.1.0 - 13.1.5 | 13.1.5.1 + Hotfix-BIGIP-13.1.5.1.0.20.2-ENG |
14.x | 14.1.0 - 14.1.5 | 14.1.5.6 + Hotfix-BIGIP-14.1.5.6.0.10.6-ENG |
15.x | 15.1.0 - 15.1.10 | 15.1.10.2 + Hotfix-BIGIP-15.1.10.2.0.44.2-ENG |
16.x | 16.1.0 - 16.1.4 | 16.1.4.1 + Hotfix-BIGIP-16.1.4.1.0.50.5-ENG |
17.x | 17.1.0 | 17.1.0.3 + Hotfix-BIGIP-17.1.0.3.0.75.4-ENG |
A list of Tenable plugins to identify affected systems can be located on the individual CVE page for CVE-2023-46747. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.
Customers that want to identify F5 BIG-IP instances can utilize our asset detection Plugin ID 76940.
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Scott joined Tenable in 2012 as a Research Engineer on the Nessus Plugins team. Over the years, he has written hundreds of plugins for Nessus, and reviewed code for even more from his time being a team lead and manager of the Plugins team. Previously leading the Security Response team and the Zero Day Research team, Scott is currently a member of the Security Response team, helping the research organization respond to the latest threats. He has over a decade of experience in the industry with previous work in the Security Operations Center (SOC) for a major domain registrar and web hosting provider. Scott is a current CISSP and actively maintains his GIAC GWAPT Web Application Penetration Tester certification.
Interests outside of work: Scott enjoys spending time with his family, camping, fishing and being outdoors. He also enjoys finding ways to break web applications and home renovation projects.
Enter your email and never miss timely alerts and security guidance from the experts at Tenable.
Formerly Tenable.io
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.
Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.
Formerly Tenable.io
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.
65 assets
Choose Your Subscription Option:
Thank you for your interest in Tenable.io. A representative will be in touch soon.
FREE FOR 7 DAYS
Tenable Nessus is the most comprehensive vulnerability scanner on the market today.
Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.
Fill out the form below to continue with a Nessus Pro Trial.
Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.
Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.
Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.
BUY
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.
65 assets
Choose Your Subscription Option:
Thank you for your interest in Tenable.io. A representative will be in touch soon.
Formerly Tenable.io Web Application Scanning
Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.
Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.
Formerly Tenable.io Web Application Scanning
Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.
Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.
Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.
Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.
Thank you for your interest in Tenable Lumin. A representative will be in touch soon.
Formerly Tenable.sc
Please fill out this form with your contact information.
A sales representative will contact you shortly to schedule a demo.
* Field is required
Formerly Tenable.ot
Get the Operational Technology Security You Need.
Reduce the Risk You Don’t.
Formerly Tenable.ad
Continuously detect and respond to Active Directory attacks. No agents. No privileges.
On-prem and in the cloud.
Exceptional unified cloud security awaits you!
We’ll show you exactly how Tenable Cloud Security helps you deliver multi-cloud asset discovery, prioritized risk assessments and automated compliance/audit reports.
Exposure management for the modern attack surface.
Formerly Tenable.asm
Know the exposure of every asset on any platform.
Thank you for your interest in Tenable Attack Surface Management. A representative will be in touch soon.
FREE FOR 7 DAYS
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.
Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.
FREE FOR 7 DAYS
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.
Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.
Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.