CVE-2023-46747 Exploitation Activity - Webserver

 1title: CVE-2023-46747 Exploitation Activity - Webserver
 2id: e9928831-ba14-42ea-a4bc-33d352b9929a
 3related:
 4    - id: f195b2ff-e542-41bf-8d91-864fb81e5c20
 5      type: similar
 6status: test
 7description: Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.
 8references:
 9    - https://github.com/AliBrTab/CVE-2023-46747-POC/tree/main
10    - https://github.com/0xorOne/nuclei-templates/blob/2fef4270ec6e5573d0a1732cb18bcfc4b1580a88/http/cves/2023/CVE-2023-46747.yaml
11    - https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
12    - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
13author: Nasreddine Bencherchali (Nextron Systems)
14date: 2023-11-08
15tags:
16    - attack.initial-access
17    - attack.t1190
18    - detection.emerging-threats
19    - cve.2023-46747
20logsource:
21    category: webserver
22    definition: 'Requirements: The POST request body data must be collected in order to make use of this detection'
23detection:
24    selection:
25        cs-method: 'POST'
26        cs-uri-stem|contains: '/mgmt/tm/util/bash'
27    keywords_hex:
28        '|all':
29            - '2f746d75692f436f6e74726f6c2f666f726d' # /tmui/Control/form
30            - '666f726d5f706167653d253266746d756925326673797374656d253266757365722532666372656174652e6a7370' # form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp
31    keywords_plain:
32        '|all':
33            - '/tmui/Control/form'
34            - 'form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp'
35    condition: selection and (keywords_hex or keywords_plain)
36falsepositives:
37    - Unlikely
38level: high

References

• GitHub - AliBrTab/CVE-2023-46747-POC: F5 BIG-IP unauthenticated remote code execution (RCE) and authentication bypass vulnerability!

  

  F5 BIG-IP unauthenticated remote code execution (RCE) and authentication bypass vulnerability! - AliBrTab/CVE-2023-46747-POC

  
  Read More

• nuclei-templates/http/cves/2023/CVE-2023-46747.yaml at 2fef4270ec6e5573d0a1732cb18bcfc4b1580a88 · jacy1101/nuclei-templates

  

  Community curated list of templates for the nuclei engine to find security vulnerabilities. - jacy1101/nuclei-templates

  
  Read More

• CVE-2023-46747| F5 BIG-IP RCE详细完整分析

  

  跟随SpringKill师傅从代码审计角度分析与复现CVE-2023-46747

  
  Read More

• Refresh: Compromising F5 BIG-IP With Request Smuggling | CVE-2023-46747 | Praetorian

  

  Overview In an effort to safeguard our customers, we perform proactive vulnerability research with the goal of identifying zero-day vulnerabilities that are likely to impact the security of leading organizations.  We decided to focus on the F5 BIG-IP suite, as F5 products are fairly ubiquitous among large corporations. We targeted the F5 BIG-IP Virtual Edition […]

  
  Read More

Related rules

• CVE-2023-46747 Exploitation Activity - Proxy
• CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)
• CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)
• CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)
• CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)