F5 BIG-IP CVE-2023-46747: Anatomy of a Critical TMUI Authentication Bypass and Remote Code Execution

Introduction

In late 2023, attackers used a flaw in F5 BIG-IP's Traffic Management User Interface (TMUI) to gain root access on enterprise and government systems worldwide. The flaw led to data theft, service outages, and persistent backdoors, all from a single unauthenticated request. It affects one of the most widely deployed pieces of network infrastructure in use today.

About F5 and BIG-IP: F5 Networks builds application delivery and security products, and its BIG-IP platform runs in Fortune 500 companies, telecoms, and government agencies. BIG-IP handles load balancing, web application firewall (WAF) duties, and access management. A vulnerability in BIG-IP therefore reaches across many industries at once.

Technical Information

CVE-2023-46747 is an authentication bypass in the TMUI component of F5 BIG-IP, scored 9.8 (Critical) on the CVSS scale. It comes from improper handling of HTTP requests in TMUI's Apache JServ Protocol (AJP) connector. Attackers can craft AJP requests that manipulate the remote_user and REMOTEROLE headers, smuggling requests that bypass authentication and grant administrative privileges.

Vulnerability Mechanism

The root cause is a difference in how BIG-IP parses binary AJP traffic versus HTTP requests. By sending a POST request with a crafted payload of exactly 0x204 bytes, attackers can:

• Set remote_user to admin
• Inject a REMOTEROLE header with value 0

TMUI then treats the request as authenticated, which gives access to configuration utilities and the ability to execute arbitrary system commands as root. The flaw is closely related to the previously acknowledged but unpatched CVE-2022-26377, which left the AJP attack surface exposed.

Attack Vectors and Exploitation

Attackers need network access to the BIG-IP management port or self-IP addresses where TMUI is exposed. Once they have it, they:

1. Send a crafted AJP packet to the TMUI AJP connector (typically TCP/8009)
2. Bypass authentication and gain admin privileges
3. Use TMUI's command execution features (such as tmsh) to run arbitrary OS commands
4. Establish persistence by creating hidden admin accounts or deploying malware

This chain is often combined with CVE-2023-46748 (SQL injection) to escalate privileges further and install web shells.

Proof of Concept

While working with the F5 BIG-IP suite, we identified a vulnerability in the Traffic Management User Interface (TMUI): an authentication bypass that can lead to unauthenticated remote code execution (RCE). The flaw, designated CVE-2023-46747, comes from improper handling of HTTP requests, which lets attackers exploit the system without authenticating first.

Understanding the Exploit Mechanism

The vulnerability lies in how HTTP requests are parsed, specifically around the Apache JServ Protocol (AJP). AJP is a binary protocol that handles communication between a web server and an application server, such as Apache Tomcat. In F5 BIG-IP, TMUI uses AJP to relay requests to backend services.

By crafting HTTP requests that manipulate the AJP protocol, an attacker can smuggle unauthorized requests through the system. The technique bypasses authentication and lets the attacker execute arbitrary system commands with administrative privileges.

Proof-of-Concept (PoC) Exploit

A public PoC exploit demonstrates the vulnerability. It sends crafted HTTP requests that exploit the AJP parsing flaw, leading to unauthorized command execution on the target. The PoC shows how the vulnerability can be used to compromise affected systems.

Implications and Recommendations

The PoC confirms how serious CVE-2023-46747 is. Organizations running F5 BIG-IP should apply the patches and the recommended mitigations. Restrict access to TMUI and keep it off untrusted networks.

PoC Reference: Praetorian Security Analysis

Patch Information

F5 Networks has fixed CVE-2023-46747 in BIG-IP by releasing hotfixes for the affected versions. These hotfixes correct the authentication bypass that let unauthenticated attackers run arbitrary system commands.

Available Hotfixes:

• BIG-IP 17.x: Upgrade to version 17.1.0.3 and apply Hotfix-BIGIP-17.1.0.3.0.75.4-ENG3.
• BIG-IP 16.x: Upgrade to version 16.1.4.1 and apply Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.
• BIG-IP 15.x: Upgrade to version 15.1.10.2 and apply Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.
• BIG-IP 14.x: Upgrade to version 14.1.5.6 and apply Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.
• BIG-IP 13.x: Upgrade to version 13.1.5.1 and apply Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.

For users who cannot apply these updates right away, F5 provides a mitigation script for BIG-IP 14.1.0 and later. The script edits configuration files to block exploitation. Do not run it on versions before 14.1.0, because it may stop the Configuration utility from starting. Customers with a FIPS 140-2 Compliant Mode license should also avoid this mitigation, since it can cause FIPS integrity checks to fail.

Mitigation Steps:

1. Download the mitigation script from the F5 support article.
2. Save the script to the affected BIG-IP system.
3. Rename the script to have a .sh extension.
4. Make the script executable using the chmod command.
5. Execute the script to apply the mitigation.

Apply these patches or mitigations to secure BIG-IP systems against this vulnerability.

Patch Reference: F5 Security Advisory

Detection Methods

Detecting unauthorized creation of experimental items in Splunk means monitoring HTTP POST requests to the /experimental/ endpoint. By analyzing logs for these requests, security teams can spot suspicious activity. Use the following Splunk search query:

splunkd_ui_access method=POST uri_path="*/experimental/*"
| stats count min(_time) as firstTime max(_time) as lastTime by clientip method uri_path uri status
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(firstTime)
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(lastTime)

The query filters for POST requests to the /experimental/ endpoint, aggregates the data by client IP and other fields, and converts the timestamps for readability. Run it regularly to find and investigate unauthorized experimental item creations.

Detection Reference: Splunk Security Content

Affected Systems and Versions

CVE-2023-46747 affects the following F5 BIG-IP versions when TMUI (the Configuration utility) is exposed via the management interface or self-IP addresses:

• BIG-IP 13.x: 13.1.0 through 13.1.5.1
• BIG-IP 14.x: 14.1.0 through 14.1.5.6
• BIG-IP 15.x: 15.1.0 through 15.1.10.2
• BIG-IP 16.x: 16.1.0 through 16.1.4.1
• BIG-IP 17.x: 17.1.0 through 17.1.0.3

All BIG-IP modules (LTM, ASM, DNS, etc.) are affected if TMUI is reachable via management or self-IP interfaces. Devices running software versions that have reached End of Technical Support (EoTS) are not evaluated and may remain vulnerable.

Vendor Security History

F5 Networks has a record of critical vulnerabilities in the BIG-IP TMUI component:

• CVE-2020-5902: Remote code execution flaw, exploited within days of disclosure.
• CVE-2022-26377: AJP protocol flaw, acknowledged but not patched, which laid the groundwork for CVE-2023-46747.
• CVE-2023-46747: The latest in a series of authentication and protocol parsing issues.

F5 has improved its coordinated disclosure and patch response, but the recurrence of high-severity TMUI flaws shows the ongoing difficulty of securing legacy code and protocol implementations.

References

• NVD Entry for CVE-2023-46747
• Official F5 Security Advisory
• Praetorian Security PoC and Analysis
• Splunk Security Content: Detection Guidance
• SecPod Blog: Exploitation in the Wild
• Help Net Security: Technical Overview

Source: This report was created using AI

If you have suggestions for improvement or feedback, please reach out to us at [email protected]