Alert: F5 Warns of Active Attacks Exploiting BIG-IP Vulnerability

F5 is warning of energetic abuse of a critical security flaw in Major-IP a lot less than a week soon after its public disclosure that could end result in the execution of arbitrary system commands as portion of an exploit chain.

Tracked as CVE-2023-46747 (CVSS rating: 9.8), the vulnerability allows an unauthenticated attacker with network entry to the Large-IP technique by the management port to achieve code execution. A proof-of-idea (PoC) exploit has due to the fact been manufactured readily available by ProjectDiscovery.

It impacts the adhering to variations of the computer software –

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

• 17.1. (Fastened in 17.1..3 + Hotfix-BIGIP-17.1..3..75.4-ENG)
• 16.1. – 16.1.4 (Fixed in 16.1.4.1 + Hotfix-BIGIP-16.1.4.1..50.5-ENG)
• 15.1. – 15.1.10 (Fixed in 15.1.10.2 + Hotfix-BIGIP-15.1.10.2..44.2-ENG)
• 14.1. – 14.1.5 (Set in 14.1.5.6 + Hotfix-BIGIP-14.1.5.6..10.6-ENG)
• 13.1. – 13.1.5 (Preset in 13.1.5.1 + Hotfix-BIGIP-13.1.5.1..20.2-ENG)

Now the organization is alerting that it has “observed risk actors employing this vulnerability to exploit CVE-2023-46748,” which refers to an authenticated SQL injection vulnerability in the Big-IP Configuration utility.

“This vulnerability may perhaps make it possible for an authenticated attacker with network accessibility to the Configuration utility via the Significant-IP management port and/or self IP addresses to execute arbitrary process instructions,” F5 observed in an advisory for CVE-2023-46748 (CVSS rating: 8.8).

In other text, undesirable actors are chaining the two flaws to run arbitrary process commands. To check for indicators of compromise (IoCs) connected with the SQL injection flaw, people are recommended to verify the /var/log/tomcat/catalina.out file for suspicious entries like under

…
java.sql.SQLException: Column not located: .
{…)
sh: no work regulate in this shell
sh-4.2$ The Shadowserver Foundation, in a post on X (formerly Twitter), said it has been “seeing F5 BIG-IP CVE-2023-46747 attempts in our honeypot sensors” since October 30, 2023, making it imperative that users move quickly to apply the fixes.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.