CVE-2023-46747
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
Description
CVE-2023-46747 is a critical authentication bypass vulnerability in the F5 BIG-IP Configuration utility that allows unauthenticated remote attackers to execute arbitrary system commands. By sending specially crafted requests, an attacker with network access to the BIG-IP management port or self IP addresses can completely bypass the Configuration utility authentication mechanism and gain full control of the system. This vulnerability affects virtually all F5 BIG-IP product modules and carries a maximum-severity CVSS score of 9.8. CISA has confirmed active exploitation of CVE-2023-46747 in the wild, including its use in ransomware campaigns, and the EPSS score of 94.4% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| f5 | big-ip access policy manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip advanced firewall manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip advanced web application firewall | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip carrier-grade nat | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip ddos hybrid defender | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip ssl orchestrator | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip domain name system | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip local traffic manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip policy enforcement manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip automation toolchain | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip container ingress services | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip application security manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip analytics | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip application acceleration manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip application visibility and reporting | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip fraud protection services | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip global traffic manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip link controller | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip webaccelerator | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip websafe | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://my.f5.com/manage/s/article/K000137353(Vendor Advisory)
- https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747(US Government Resource)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The F5 BIG-IP Configuration utility contains an authentication bypass weakness where undisclosed request paths allow attackers to circumvent the normal authentication mechanism entirely. This alternate path vulnerability enables unauthenticated access to functionality that should require valid credentials, ultimately leading to system command execution on the BIG-IP appliance.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
CWE-306: Missing Authentication for Critical Function
Certain critical functions within the BIG-IP Configuration utility lack proper authentication enforcement. In the context of CVE-2023-46747, the system fails to verify that requests to sensitive management functions originate from authenticated users, allowing remote attackers to invoke privileged operations without any credentials.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2023-46747 carries a CRITICAL severity rating with a CVSS v3.1 score of 9.8, representing the highest tier of risk for enterprise infrastructure. The vulnerability is remotely exploitable without physical access and requires low attack complexity with no special conditions needed. No authentication is required to exploit this flaw, and no user interaction is needed, making it trivially exploitable by any network-adjacent attacker. Confidentiality (High): attackers gain full access to BIG-IP configurations, credentials, SSL certificates, and all traffic passing through the appliance. Integrity (High): complete system compromise allows modification of traffic management policies, insertion of backdoors, and alteration of security configurations. Availability (High): attackers with command execution privileges can disrupt or shut down BIG-IP services that are often critical to enterprise application delivery. The EPSS score of 94.4% underscores the near-certain likelihood of exploitation, and CISA has confirmed this vulnerability is actively used in ransomware campaigns, making immediate remediation essential.
Exploit Maturity
Public exploit code is available for CVE-2023-46747 via Packet Storm Security, which provides a remote command execution exploit leveraging AJP smuggling against the BIG-IP TMUI. Additional exploit documentation is available from SecPod, detailing active exploit chains in the wild. CISA has confirmed active exploitation and has specifically noted that this vulnerability is used in ransomware campaigns. The EPSS score of 94.4% (99.9th percentile) indicates near-certain exploitation activity, placing this among the most actively exploited vulnerabilities currently tracked. CVE-2023-46747 is frequently chained with CVE-2023-46748, an authenticated SQL injection flaw in the same Configuration utility, where the authentication bypass from CVE-2023-46747 enables unauthenticated exploitation of the SQL injection.
Remediation
- Apply vendor mitigations immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Consult F5 advisory K000137353 for the specific patched versions covering all affected BIG-IP modules. Given the ransomware association, treat this as the highest-priority patch.
- Restrict network access to the BIG-IP management interface by ensuring the Configuration utility (TMUI) is not accessible from untrusted networks. Block access to the management port from the internet and limit it to dedicated management VLANs with strict firewall rules allowing only authorized administrator IP addresses.
- Deploy detection rules for AJP smuggling attacks targeting the BIG-IP management interface. Configure intrusion detection/prevention systems to alert on anomalous HTTP requests to the Configuration utility that exhibit request smuggling characteristics, and enable WAF rules to block malformed requests.
- Conduct immediate forensic analysis on all exposed BIG-IP systems by reviewing access logs for the Configuration utility, checking for unauthorized user accounts or configuration changes, inspecting for web shells or backdoors, and verifying the integrity of SSL certificates and traffic policies. Kill all active sessions and rotate all credentials.
- Implement defense-in-depth controls including multi-factor authentication for management access, network microsegmentation isolating BIG-IP management planes, and continuous monitoring with alerting on any management interface access from unexpected sources.
Technical Details
CVE-2023-46747 exploits a fundamental authentication bypass weakness in the F5 BIG-IP Configuration utility (TMUI). The vulnerability involves two related weakness types: CWE-288 (authentication bypass using an alternate path) and CWE-306 (missing authentication for critical function), which together enable unauthenticated access to system command execution. The exploit leverages AJP (Apache JServ Protocol) smuggling to bypass the front-end authentication layer, sending specially crafted requests that reach backend functionality without proper credential validation. As reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U), the attack requires no authentication, no user interaction, and is trivially executed over the network with low complexity. The scope is unchanged (S:U), but the complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) means an attacker gains full control over the BIG-IP system, including the ability to intercept, modify, or disrupt all traffic managed by the appliance.
Frequently Asked Questions
Is CVE-2023-46747 being actively exploited?
Yes, CVE-2023-46747 is under widespread active exploitation. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 21, 2023, and has confirmed its use in ransomware campaigns. The EPSS score of 94.4% places it in the 99.9th percentile, indicating near-certain exploitation activity.
What products are affected by CVE-2023-46747?
CVE-2023-46747 affects virtually all F5 BIG-IP product modules, including Access Policy Manager, Advanced Firewall Manager, Advanced Web Application Firewall, Local Traffic Manager, Application Security Manager, Domain Name System, SSL Orchestrator, Carrier-Grade NAT, DDoS Hybrid Defender, Policy Enforcement Manager, and additional modules. Software versions that have reached End of Technical Support are not evaluated by F5.
How do I fix CVE-2023-46747?
Immediately apply the patches referenced in F5 advisory K000137353 to all affected BIG-IP modules. As an interim measure, restrict all network access to the BIG-IP Configuration utility management port and self IP addresses to trusted networks only. Given the ransomware association, this should be treated as the highest-priority remediation action.
How severe is CVE-2023-46747?
CVE-2023-46747 is rated CRITICAL with a CVSS v3.1 score of 9.8 out of 10, the highest severity tier. It requires no authentication and no user interaction to exploit, and it grants attackers full system command execution capabilities. The EPSS score places it at the 99.9th percentile, and it is actively used in ransomware campaigns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.