F5 BIG-IP AJP Request Smuggling Auth Bypass RCE
- Product
- F5 BIG-IP Configuration utility
- CVE
- CVE-2023-46747
- Disclosed
- 2023-10-26
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- BIG-IP 17.1.0, 16.1.0-16.1.4, 15.1.0-15.1.10, 14.1.0-14.1.5, 13.1.0-13.1.5.
- Fixed
- Engineering hotfixes per K000137353 (e.g. 17.1.0.3, 16.1.4.1, 15.1.10.2 + hotfix); later releases 17.1.1+.
Summary
Praetorian found that request smuggling between Apache and Tomcat in the BIG-IP Configuration utility allowed unauthenticated attackers to create admin users and run commands. Exploitation started within days of disclosure.
Root cause
The front-end Apache forwards TMUI requests to Tomcat over AJP. A crafted request causes Apache and Tomcat to disagree on request boundaries (AJP smuggling), so a second, hidden request reaches Tomcat as an internally trusted, authenticated request.
Impact
Unauthenticated creation of administrator accounts and root command execution.
Detection
Check for unexpected admin users and review /var/log/tomcat/catalina.out and audit logs. Nuclei template CVE-2023-46747.
Mitigation
Apply hotfixes and restrict Configuration utility access to trusted networks.