CVE-2023-46748

What it actually does

CVE-2023-46748 is an authenticated SQL injection flaw in the F5 BIG-IP Configuration utility. An attacker with valid credentials and network reachability to the BIG-IP management interface or exposed self IP Configuration utility can inject SQL into backend queries and abuse the resulting application behavior to execute arbitrary operating system commands on the appliance. Successful exploitation can compromise confidentiality, integrity, and availability by allowing command execution, configuration theft or modification, credential/secret harvesting, account creation, persistence, and service disruption on BIG-IP systems running vulnerable software.

Why it matters to the business

A compromised BIG-IP device can expose traffic-routing, DNS, WAF, VPN, firewall, access-policy, and application-delivery infrastructure to attacker control. Because BIG-IP devices often sit in front of critical applications and handle sensitive authentication, TLS, and traffic-management functions, exploitation can lead to outage, interception of application traffic, unauthorized configuration changes, or a foothold for broader network intrusion. This vulnerability is in CISA KEV with a remediation due date of 2023-11-21, meaning exploitation has been observed in the wild and the federal remediation deadline has long passed; organizations should treat any still-exposed vulnerable instance as high priority even though exploitation requires credentials.

How an attack unfolds

An attacker first obtains valid BIG-IP credentials through phishing, password reuse, credential stuffing, prior compromise, exposed backups, or abuse of another vulnerability. The attacker then connects to the BIG-IP Configuration utility over the management port or a self IP address where the utility is reachable. After authenticating, the attacker submits crafted input that alters SQL queries processed by the Configuration utility. The SQL injection can be chained into arbitrary system command execution on the appliance. Once code execution is achieved, the attacker may run shell commands, enumerate configuration and secrets, create or modify administrative users, change traffic-management policy, disable logging, stage tools in temporary directories, or pivot using the BIG-IP device’s privileged network position. Public reporting and KEV inclusion indicate real-world exploitation activity, so investigation should focus on suspicious authenticated management activity as well as post-exploitation commands.

How to fix it

Upgrade affected BIG-IP software to a vendor-supported fixed release or hotfix for the deployed branch according to the current F5 security advisory for this vulnerability. If a system is on an End of Technical Support release, migrate to a supported fixed version because EoTS versions were not evaluated and may remain vulnerable. Restrict access to the BIG-IP Configuration utility to dedicated management networks, VPNs, or bastion hosts only; do not expose the management UI to the internet or untrusted networks. On self IPs, use Port Lockdown to limit allowed services and ensure the Configuration utility is not reachable where it is not explicitly required. Enforce MFA for administrative access where supported, rotate potentially exposed credentials, remove unused accounts, and review role assignments. If immediate upgrade is not possible, apply vendor-published mitigations, network ACLs, and management-plane isolation as compensating controls, but treat these as temporary until the software is patched.

How to confirm the fix worked

Confirm the running BIG-IP version and hotfix level with administrative tooling such as the Configuration utility or tmsh, then compare it against the fixed versions listed in the current F5 advisory. Verify that the Configuration utility is reachable only from approved management networks and not from public, partner, application, or user subnets. Test self IP exposure by confirming Port Lockdown settings and externally validating that management services are not reachable where unnecessary. Review installed hotfixes and ensure all affected BIG-IP modules on the device are covered by the patched platform version. After remediation, perform authenticated vulnerability scanning or vendor-supported checks against the management interface. Validate that administrative accounts, authentication configuration, traffic policies, iRules, WAF policy, DNS/GTM/LTM configuration, and device trust settings have not been unexpectedly changed before returning the appliance to normal operation.

Typical attack path

1. Obtain valid BIG-IP user credentials or session material.
2. Identify a reachable BIG-IP Configuration utility on the management interface or exposed self IP address.
3. Authenticate to the Configuration utility.
4. Send crafted input that triggers SQL injection in the vulnerable application logic.
5. Leverage the injection to cause arbitrary system command execution on the BIG-IP appliance.
6. Run discovery commands and collect BIG-IP configuration, keys, credentials, tokens, and network information.
7. Create persistence such as new users, altered authentication settings, scheduled commands, or dropped files.
8. Modify or disrupt BIG-IP services, traffic policies, access controls, WAF rules, DNS behavior, or application delivery configuration.
9. Clean up logs or artifacts and use the appliance as a staging point for additional intrusion activity.

How to detect it

Investigate whether the BIG-IP Configuration utility was accessed by unusual users, from unusual IP addresses, at unusual times, or followed by unexpected command execution or configuration changes. Relevant log sources include BIG-IP audit logs, web server logs, system logs, authentication logs, tmsh command history where available, iControl REST logs, and centralized SIEM records. Review /var/log/audit for administrative actions, /var/log/ltm for system and configuration events, /var/log/secure for authentication events, /var/log/httpd/* for Configuration utility access and errors, and /var/log/restjavad* for REST-related activity. Look for SQL error messages, suspicious HTTP parameters containing SQL metacharacters, authenticated requests to management endpoints followed by shell execution, unexpected use of tmsh or bash, new or modified admin users, disabled logging, altered Port Lockdown settings, changed auth sources, modified iRules, and unexplained configuration saves. Also inspect temporary and shared directories for recently created scripts, binaries, web-accessible files, archives, or download tools. Because exploitation requires authentication, correlate successful login events with subsequent anomalous management actions rather than only looking for unauthenticated probes.

• /var/log/audit
• /var/log/ltm
• /var/log/secure
• /var/log/httpd/httpd_errors
• /var/log/httpd/access_log
• /var/log/restjavad.0.log
• /var/log/tomcat/catalina.out
• SQLException
• SQL syntax
• SQLSyntaxErrorException
• You have an error in your SQL syntax
• /mgmt/tm/util/bash
• /mgmt/tm/util/cmd
• tmsh create auth user
• tmsh modify auth user
• tmsh save sys config
• tmsh modify sys httpd
• tmsh modify net self
• tmsh modify sys global-settings gui-setup disabled
• bash -c
• /bin/bash
• /bin/sh
• curl http
• wget http
• chmod +x
• /var/tmp/
• /tmp/
• /shared/tmp/
• /config/filestore/
• authorized_keys
• crontab
• /etc/cron.d/
• /var/spool/cron/

What your security team should do

• Immediately inventory all BIG-IP appliances and determine which are running vulnerable or unsupported software branches.
• Prioritize remediation for any device whose Configuration utility is reachable from the internet, broad internal networks, self IPs, or third-party networks.
• Upgrade to a vendor-supported fixed BIG-IP release or hotfix; migrate EoTS systems to supported versions.
• If patching cannot be completed immediately, restrict management UI access with ACLs, firewall rules, VPN/bastion requirements, and self IP Port Lockdown.
• Review the last 90 days or more of BIG-IP management, audit, web, and system logs for suspicious authenticated activity and command execution.
• Rotate passwords, API tokens, and administrative credentials for BIG-IP users, especially if suspicious activity is found.
• Audit local users, remote authentication settings, device trust, iRules, traffic policies, WAF policies, DNS/GTM/LTM objects, and scheduled tasks for unauthorized changes.
• Hunt for files or tools staged in temporary directories such as /var/tmp, /tmp, and /shared/tmp on BIG-IP appliances.
• Enable centralized logging for BIG-IP management, audit, HTTPD, tmsh, and system logs so future exploitation attempts are retained off-device.
• Treat confirmed exploitation as a network-edge compromise and perform incident response, including configuration integrity review and downstream credential exposure assessment.