Well, that didn't take long. #cve202346747 has now been reported by F5 as being exploited in the wild. This can be found in an updated section of the advisory towards the bottom at https://my.f5.com/manage/s/article/K000137353.

Interestingly enough, the in-the-wild exploitation is using the SQL injection vulnerability (CVE-2023-46748) in conjunction with the AJP request smuggling attack to achieve access. This vulnerability was also included in the same KB advisory as the AJP request smuggling attack.

Originally I wasn't sure if the SQL injection vuln report was the other security researcher(s) who had also reported the AJP Request Smuggling content to F5, but given the way this is being exploited in the wild it sure looks like this is the case.

Since @pdnuclei has posted a full PoC for #cve202346747 already, we've updated our blog post at https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/ with all the technical details.

Kudos to @rootxharsh and @iamnoooob for SUCH a quick reproduction of the bug as well!

A warning for folks who are going to start spraying this around though:

The process of abusing AJP request smuggling causes Tomcat and Apache to get out of sync. So as you send more of these requests, the de-sync gets worse. Eventually the server gets so out of sync that it becomes incapable of actually serving the correct site once you ask for it.

During testing we regularly would get our F5-BIGIP so jammed up that it was just faster to do a full server reboot than it was to wait for things to clear out normally. There's a secondary bug here in that if you do this enough, you'll eventually catch the login session of someone else trying to hit the server, but given the fact that you can get RCE through this as well, it seems not to be as huge of a deal.

I do hope folks patched though - if you weren't paying attention on Thursday/Friday you're gonna get snuck by this one pretty badly. A 72 hour window isn't a massive amount of time unfortunately.

For what it's worth, at a glance there wasn't anything SUPER insane exposed on the internet when we did a check. We did find one cisa.gov server, which we notified them about and it was taken down before the ball started rolling on this stuff. Lots and lots of telecoms though.

Looks like the good folks at Project Discovery have implemented the full F5 RCE attack chain in a Nuclei Template already. That didn't take long at all, I suspect we'll be posting the rest of the blog this week.

https://github.com/projectdiscovery/nuclei-templates/pull/8496

#CVE202346747 #f5 #nuclei #projectdiscovery