CVE-2023-46747 Exploitation Activity - Proxy

calendar Oct 1, 2024 · attack.initial-access attack.t1190 detection.emerging-threats cve.2023-46747  ·
Share on: linkedin copy

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

Sigma rule (View on GitHub)

 1title: CVE-2023-46747 Exploitation Activity - Proxy
 2id: f195b2ff-e542-41bf-8d91-864fb81e5c20
 3related:
 4    - id: e9928831-ba14-42ea-a4bc-33d352b9929a
 5      type: similar
 6status: test
 7description: Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.
 8references:
 9    - https://github.com/AliBrTab/CVE-2023-46747-POC/tree/main
10    - https://github.com/0xorOne/nuclei-templates/blob/2fef4270ec6e5573d0a1732cb18bcfc4b1580a88/http/cves/2023/CVE-2023-46747.yaml
11    - https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
12    - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
13author: Nasreddine Bencherchali (Nextron Systems)
14date: 2023-11-08
15tags:
16    - attack.initial-access
17    - attack.t1190
18    - detection.emerging-threats
19    - cve.2023-46747
20logsource:
21    category: proxy
22    definition: 'Requirements: The POST request body data must be collected in order to make use of this detection'
23detection:
24    selection:
25        cs-method: 'POST'
26        c-uri|contains: '/mgmt/tm/util/bash'
27    keywords_hex:
28        '|all':
29            - '2f746d75692f436f6e74726f6c2f666f726d' # /tmui/Control/form
30            - '666f726d5f706167653d253266746d756925326673797374656d253266757365722532666372656174652e6a7370' # form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp
31    keywords_plain:
32        '|all':
33            - '/tmui/Control/form'
34            - 'form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp'
35    condition: selection and (keywords_hex or keywords_plain)
36falsepositives:
37    - Unlikely
38level: high

References

Related rules

to-top