CVE-2023-46748
F5 BIG-IP Configuration Utility SQL Injection Vulnerability
Description
CVE-2023-46748 is an authenticated SQL injection vulnerability in the F5 BIG-IP Configuration utility. The flaw allows an authenticated attacker with network access to the BIG-IP management port or self IP addresses to execute arbitrary system commands on the underlying operating system. This SQL injection security vulnerability affects a wide range of F5 BIG-IP product modules, including Access Policy Manager, Local Traffic Manager, Advanced Firewall Manager, and many others. CISA has added CVE-2023-46748 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with an EPSS score of 4.3% indicating ongoing but targeted exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| f5 | big-ip access policy manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip advanced firewall manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip carrier-grade nat | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip ddos hybrid defender | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip ssl orchestrator | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip local traffic manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip policy enforcement manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip automation toolchain | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip container ingress services | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip advanced web application firewall | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip domain name system | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip application security manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip analytics | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip application acceleration manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip application visibility and reporting | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip fraud protection services | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip global traffic manager | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip link controller | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip webaccelerator | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
| f5 | big-ip websafe | >= 13.1.0, <= 13.1.5; >= 14.1.0, <= 14.1.5; >= 15.1.0, <= 15.1.10; >= 16.1.0, <= 16.1.4; >= 17.1.0, <= 17.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://my.f5.com/manage/s/article/K000137365(Vendor Advisory)
- https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46748(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
The BIG-IP Configuration utility fails to properly sanitize user-supplied input before incorporating it into SQL queries. This SQL injection weakness in the Configuration utility allows an authenticated attacker to manipulate database queries and ultimately execute arbitrary system commands on the BIG-IP appliance.
Learn more: CWE-89 — SQL Injection
Impact Analysis
CVE-2023-46748 is rated HIGH severity with a CVSS v3.1 score of 8.8, reflecting significant risk to affected F5 BIG-IP deployments. The vulnerability is remotely exploitable without physical access and requires low attack complexity, meaning no special conditions are needed to carry out an attack. While the attacker needs low-level authentication to the Configuration utility, no user interaction is required to trigger the exploit. Confidentiality (High): successful exploitation can expose sensitive configuration data and credentials stored in the BIG-IP system. Integrity (High): attackers can modify system configurations and execute arbitrary commands, potentially altering traffic management rules or security policies. Availability (High): command execution with system-level privileges can lead to complete service disruption of BIG-IP infrastructure, which often sits at critical points in enterprise network architecture.
Exploit Maturity
Public exploit information is available for CVE-2023-46748 via SecPod, which documents the vulnerability being used in active exploit chains. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 21, 2023. The EPSS score of 4.3% (88th percentile) suggests that while exploitation is not widespread, targeted attacks against BIG-IP infrastructure are occurring. Notably, CVE-2023-46748 has been observed being chained with CVE-2023-46747, an authentication bypass vulnerability in the same BIG-IP Configuration utility, allowing attackers to exploit this SQL injection without requiring prior authentication.
Remediation
- Apply vendor mitigations immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Refer to F5 advisory K000137365 for specific patched versions and hotfixes for all affected BIG-IP modules.
- Restrict access to the BIG-IP Configuration utility by ensuring the management port is not exposed to untrusted networks. Use network segmentation and firewall rules to limit access to the management interface to authorized administrators from trusted IP ranges only.
- Implement SQL injection defenses by deploying web application firewall (WAF) rules on any load balancers or reverse proxies fronting the management interface. Enable input validation and parameterized query enforcement where possible in the BIG-IP configuration.
- Audit BIG-IP systems for indicators of compromise by reviewing Configuration utility access logs, checking for unauthorized configuration changes, and inspecting system command execution logs. Look for anomalous SQL query patterns or unexpected administrative actions.
- Harden the BIG-IP management plane by enforcing multi-factor authentication for Configuration utility access, implementing role-based access controls with least-privilege principles, and disabling any unused management interfaces or self IP addresses.
Technical Details
CVE-2023-46748 is a SQL injection vulnerability residing in the BIG-IP Configuration utility, which serves as the web-based management interface for F5 BIG-IP appliances. The vulnerability stems from improper neutralization of special elements in user-supplied input before it is incorporated into SQL commands processed by the Configuration utility backend. As indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U), the attack is network-accessible with low complexity, requiring only low-level authenticated access to the management interface without any user interaction. An attacker who successfully injects malicious SQL statements can escalate from database manipulation to arbitrary system command execution, effectively gaining control over the BIG-IP operating system. The scope remains unchanged (S:U), meaning the impact is confined to the BIG-IP system itself, but given that BIG-IP devices typically manage critical network traffic, compromise of a single appliance can have cascading effects across the infrastructure it serves.
Frequently Asked Questions
Is CVE-2023-46748 being actively exploited?
Yes, CVE-2023-46748 is being actively exploited. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 21, 2023. The vulnerability has been observed being used in exploit chains alongside CVE-2023-46747 to target F5 BIG-IP systems.
What products are affected by CVE-2023-46748?
CVE-2023-46748 affects a broad range of F5 BIG-IP product modules, including BIG-IP Access Policy Manager, Advanced Firewall Manager, Local Traffic Manager, Application Security Manager, Domain Name System, SSL Orchestrator, Carrier-Grade NAT, DDoS Hybrid Defender, Advanced Web Application Firewall, and several other modules. Software versions that have reached End of Technical Support are not evaluated.
How do I fix CVE-2023-46748?
Apply the patches or hotfixes provided by F5 as documented in advisory K000137365. Immediately restrict network access to the BIG-IP Configuration utility management port and self IP addresses to trusted networks only. See the Remediation section for detailed steps including monitoring and hardening guidance.
How severe is CVE-2023-46748?
CVE-2023-46748 is rated HIGH severity with a CVSS v3.1 score of 8.8 out of 10. The vulnerability allows authenticated attackers to execute arbitrary system commands via SQL injection. With an EPSS score at the 88th percentile, it ranks higher than the majority of known vulnerabilities in terms of exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.