Attack Chain

1. The attacker identifies a vulnerable F5 BIG-IP instance with TMUI enabled.
2. The attacker sends a crafted HTTP PATCH request to the /mgmt/tm/auth/user/ endpoint.
3. The crafted request bypasses authentication checks due to the vulnerability in TMUI.
4. The system incorrectly grants the attacker access as an authenticated user.
5. The attacker leverages the unauthorized access to execute arbitrary commands on the system.
6. The attacker may install a web shell or other persistent backdoor for continued access.
7. The attacker escalates privileges to gain root access.
8. The attacker exfiltrates sensitive data, disrupts services, or performs other malicious activities.

Impact

Successful exploitation of CVE-2023-46747 can have severe consequences. An attacker can gain complete control over the F5 BIG-IP system, leading to disruption of critical services, data breaches, and financial losses. Given that F5 BIG-IP devices are often used in large enterprise networks, a successful attack could have a widespread impact, affecting numerous users and applications.

Recommendation

• Deploy the Sigma rule F5 TMUI Authentication Bypass to your SIEM and tune for your environment, focusing on web server logs.
• Immediately patch CVE-2023-46747 on all affected F5 BIG-IP systems (reference: F5 security advisory).
• Monitor web server logs for PATCH requests to the /mgmt/tm/auth/user/ URI path, as highlighted in the Sigma rule.
• Inspect web traffic for unusual HTTP user agents associated with CVE-2023-46747 exploitation.