Security News > 2023 > November > Critical vulnerability in F5 BIG-IP under active exploitation
The cybersecurity biz confirmed in an update to its advisory for CVE-2023-46747 that it has evidence of active exploitation in the wild, less than five days after the initial limited-detail research was published by Praetorian.
This critical Apache JServ Protocol smuggling vulnerability was what attracted much of the attention to F5's BIG-IP configuration utility last week.
Among these was CVE-2023-46748, an SQL injection vulnerability with an 8.8 severity score.
Michael Weber, co-author of the Praetorian research which first publicized the AJP smuggling vulnerability last week, said he suspects F5 knew a larger exploit chain was on the horizon based on the report handed to the company by a second researcher around two weeks before Praetorian disclosed it to F5. "Interestingly enough, the in-the-wild exploitation is using the SQL injection vulnerability in conjunction with the AJP request smuggling attack to achieve access," he said on Mastodon.
Researchers often delay or withhold key parts of vulnerability research from becoming public knowledge through fear of attackers using reports to reverse engineer an exploit for a given vulnerability before patches can be applied.
The same was true with Praetorian's research from October 26, which omitted many of the key details of how its researchers were able to achieve remote code execution by exploiting the APJ smuggling vulnerability.
- Alert: Ivanti Releases Patch for Critical Vulnerability in Endpoint Manager Solution (source)
- Act Now: CISA Flags Active Exploitation of Microsoft SharePoint Vulnerability (source)
- GitLab warns of critical zero-click account hijacking vulnerability (source)
- Critical RCE Vulnerability Uncovered in Juniper SRX Firewalls and EX Switches (source)
- Patch time: Critical GitLab vulnerability exposes 2FA-less users to account takeovers (source)
- ~40,000 Attacks in 3 Days: Critical Confluence RCE Under Active Exploitation (source)
- Critical Jenkins Vulnerability Exposes Servers to RCE Attacks - Patch ASAP! (source)
- CISA Warns of Active Exploitation Apple iOS and macOS Vulnerability (source)
- Critical vulnerability in Mastodon is pounced upon by fast-acting admins (source)
- Critical Boot Loader Vulnerability in Shim Impacts Nearly All Linux Distros (source)
| SQL Injection vulnerability in F5 products
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
| Missing Authentication for Critical Function vulnerability in F5 products
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated