Hardening F5 BIG-IP TMUI: Blue Team Defense Guide

Md. Redwan Ahmed Md. Redwan Ahmed
·
Hardening F5 BIG-IP TMUI: Blue Team Defense Guide

Overview & Defensive Context: The Fallacy of Perimeter Web Management Security#

Harden F5 BIG-IP against CVE-2023-46747: isolate TMUI port lockdown, deploy the hotfix mitigation script, and audit AJP access logs.

In our morning threat architecture analysis, we deconstructed the offensive mechanics of CVE-2023-46747 (mapped to MITRE ATT&CK T1190: Exploit Public-Facing Application, T1078: Valid Accounts, and T1059.004: Command and Scripting Interpreter: Unix Shell). We demonstrated how remote adversaries weaponized an architectural desynchronization flaw between the front-end Apache HTTP Server (httpd) and the back-end Apache Tomcat servlet engine within the F5 BIG-IP Traffic Management User Interface (TMUI). By smuggling binary Apache JServ Protocol version 1.3 (AJP13) FORWARD_REQUEST frames inside the body of chunked HTTP requests, unauthenticated attackers injected privileged environment attributes (remote_user = "admin" and REMOTEROLE = "0"). This completely bypassed the appliance's authentication boundary, allowing direct interaction with internal administrative endpoints such as /tmui/locallb/workspace/tmshCmd.jsp to execute arbitrary commands through the Traffic Management Shell (tmsh) with full root privileges.

For enterprise perimeter architects, network security engineers, and blue teams, defending F5 BIG-IP deployments against CVE-2023-46747 exposes critical blind spots in edge device governance:

  • The Dangerous Conflation of Data Planes and Management Planes: The most prevalent architectural root cause enabling the wide-scale exploitation of CVE-2023-46747 is the exposure of the TMUI web configuration utility on data plane interfaces. In default or poorly audited configurations, administrators frequently bind "Self IP" addresses across external or transit VLANs with default port policies (allow-service default or allow-service all). This inadvertently exposes TCP port 443 (the TMUI management web server) to untrusted traffic traversing client-facing interfaces, completely undermining perimeter firewalls.
  • The Failure of Traditional Web Application Firewalls (WAFs): Standard WAF rules operating in front of BIG-IP management interfaces frequently fail to inspect or decode binary payloads embedded inside chunked HTTP POST request bodies. Because the initial HTTP request targets a standard login page (/tmui/login.jsp) and appears syntactically well-formed, network layer filters pass the traffic. The binary AJP bytes (0x12 0x34) remain inert until interpreted by Tomcat's internal AJP connector, creating an undetectable bypass unless explicit request-body boundary inspection is enforced.
  • The High Blast Radius of Perimeter ADC Compromise: An Application Delivery Controller (ADC) is not merely a single web server; it is the cryptographic and operational gateway for an entire enterprise. Compromising an F5 BIG-IP appliance grants threat actors immediate visibility into decrypted TLS sessions, access to private keys and API tokens, the ability to harvest corporate credentials via altered authentication iRules, and an unmonitored foothold for lateral movement into protected internal data center VLANs.
  • The Structural Risk of Protocol Impedance Mismatches: Translating text-based HTTP/1.1 requests into a binary stream over AJP13 creates fundamental protocol synchronization vulnerabilities. While modern microservices architectures utilize standardized, cryptographically verified gRPC or mTLS connections for inter-process communication, legacy enterprise appliances often rely on unauthenticated local protocols like AJP. When the front-end proxy and back-end servlet engine interpret message boundaries differently—such as handling empty chunks or trailing headers—attackers can smuggle commands that inherit the proxy's implicit trust.
  • The Operational Challenge of Multi-Tenant Appliance Governance: In large enterprise deployments, F5 BIG-IP systems are partitioned across multiple administrative domains using Administrative Partitions and Route Domains. When emergency hotfixes or mitigation scripts are deployed, administrators frequently update only the default Common partition, leaving secondary partitions or route domains exposed. Complete remediation requires systematic forest-wide verification across all configured interfaces, route domains, and cluster nodes.
  • The Critical Necessity of Independent Cluster Node Remediation: In high-availability (HA) pairs running active/standby or active/active configurations, native BIG-IP ConfigSync (tmsh run cm config-sync) synchronizes user configurations (bigip.conf), but does NOT synchronize underlying Linux operating system configuration files such as /etc/httpd/conf/httpd.conf. Applying a hotfix script on the primary active unit leaves the standby unit completely unpatched unless the mitigation is executed manually across every physical chassis and virtual edition (VE) instance in the sync-failover group.
  • The Urgency of Multi-Tiered Blue Team Hardening: Protecting BIG-IP infrastructure against AJP smuggling requires an integrated defense strategy: immediately applying the official F5 engineering hotfix or executing the F5-Hotfix-CVE-2023-46747.sh mitigation script, enforcing strict Self IP Port Lockdown: Allow None, isolating TMUI access to dedicated out-of-band (OOB) management networks, and deploying high-fidelity Sigma and audit rules to detect active post-exploitation footholds.
Warning

Running the official mitigation script modifies Apache HTTPd proxy configurations to disable AJP forwarding, providing immediate protection without a full system reboot. However, administrators must verify that Self IP Port Lockdown policies are actively set to Allow None across all production interfaces to ensure complete perimeter isolation.

⚔️ Exploitation Mechanics: For root-cause memory corruption analysis and attack flow, see our deep-dive: Deconstructing Breakdown.

Architecture Hardening: Five-Tier Defense-in-Depth for F5 BIG-IP TMUI#

Establishing complete resilience against CVE-2023-46747 requires deploying technical controls across five architectural tiers: hotfix and script remediation, Self IP port lockdown isolation, management access control lists, WAF payload inspection, and host forensic telemetry.

Defense Architecture Flowchart#

flowchart TD
    classDef client fill:#1e293b,stroke:#ef4444,stroke-width:2px,color:#f8fafc
    classDef gate fill:#0f172a,stroke:#3b82f6,stroke-width:2px,color:#93c5fd
    classDef secure fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#6ee7b7
    classDef audit fill:#4c1d95,stroke:#8b5cf6,stroke-width:2px,color:#ddd6fe
    classDef drop fill:#450a0a,stroke:#dc2626,stroke-width:2px,color:#fca5a5
    classDef pass fill:#065f46,stroke:#34d399,stroke-width:2px,color:#a7f3d0

    Attacker[External Untrusted Client Attempts AJP Smuggling Exploit]:::client --> PortCheck{Tier 1: Self IP Port Lockdown Gate}:::gate

    PortCheck -- Port Lockdown: Allow-Service None --> DropNetwork[Action: Kernel Drops TCP SYN on Port 443]:::drop
    PortCheck -- Port Lockdown: Allow Default or All --> WAFGate{Tier 2: Edge WAF and Protocol Inspection}:::gate

    WAFGate -- Signature Matches Binary AJP 0x1234 or tmshCmd.jsp --> WAFBlock[Action: WAF Drops HTTP Connection with 403 Forbidden]:::drop
    WAFBlock --> AlertWAF[Log WAF Violation Event to SIEM]:::audit

    WAFGate -- Request Passes to Apache httpd Proxy --> IPCheck{Tier 3: Management httpd Access Control List}:::gate

    IPCheck -- Client IP Not in Allowed Subnets --> ApacheDeny[Action: Apache Rejects Connection: 403 Forbidden]:::drop
    IPCheck -- Client IP Matches Trusted CIDR --> PatchGate{Tier 4: Hotfix and Mitigation Script State}:::gate

    PatchGate -- F5 Hotfix Active: AJP Forwarding Terminated --> SafeProxy[Action: Apache Denies Internal AJP Tunneling]:::pass
    SafeProxy --> DropSmuggle[Smuggled AJP Frame Discarded: Zero Backend Execution]:::secure

    PatchGate -- Unpatched Appliance: mod_proxy_ajp Active --> TomcatDesync{Vulnerable mod_proxy_ajp Execution}:::gate
    TomcatDesync -- Request Smuggled into tmshCmd.jsp --> RootExec[Critical: Unauthorized tmsh Execution]:::drop

    RootExec --> Tier5Audit{Tier 5: Auditd and LTM Log Telemetry}:::audit
    Tier5Audit --> SIEMAlert[Alert: Rogue tmsh User Creation Detected in /var/log/ltm]:::drop

Tier 1: Engineering Hotfixes & Official Mitigation Script Execution#

The primary technical remediation for CVE-2023-46747 is applying the official F5 software release or deploying the vendor-provided mitigation script.

Official Fixed BIG-IP Software Versions:

  • BIG-IP 17.1.x: Upgrade to 17.1.0.3 or newer
  • BIG-IP 16.1.x: Upgrade to 16.1.4.1 or newer
  • BIG-IP 15.1.x: Upgrade to 15.1.10.2 or newer
  • BIG-IP 14.1.x: Upgrade to 14.1.5.6 or newer
  • BIG-IP 13.1.x: Upgrade to 13.1.5.1 or newer

Non-Disruptive Mitigation Script Deployment

For production appliances where immediate maintenance windows for software upgrades cannot be scheduled, F5 released an official mitigation shell script (F5-Hotfix-CVE-2023-46747.sh).

The script inspects the appliance's configuration, modifies /etc/httpd/conf/httpd.conf to insert an Apache configuration include (/config/httpd/conf.d/proxy_ajp.conf), terminates vulnerable unauthenticated AJP proxy mappings, and gracefully restarts the httpd and tomcat daemons without rebooting the underlying BIG-IP hardware.

Specifically, the script injects Apache rewrite rules that inspect the Transfer-Encoding and Content-Length headers, rejecting any request attempting ambiguous framing. Furthermore, it modifies Tomcat's AJP connector configuration in /var/tmp/server.xml to require an internal shared secret token (secretRequired="true" and secret="<cryptographic_token>"), preventing arbitrary local processes or smuggled connections from establishing unauthenticated AJP sessions:

BASH 
# Verify appliance version and operational status
tmsh show sys version

# Download and verify the official F5 mitigation script
# Note: Transfer script securely via SCP to /var/tmp/
cd /var/tmp/
chmod +x F5-Hotfix-CVE-2023-46747.sh

# Execute the mitigation script as root
./F5-Hotfix-CVE-2023-46747.sh

# The script performs the following actions:
# 1. Backs up /etc/httpd/conf/httpd.conf to /etc/httpd/conf/httpd.conf.cve-2023-46747.bak
# 2. Configures Apache include directives to block unauthenticated AJP tunneling
# 3. Restarts web daemons via bigstart restart httpd tomcat

# Verify that daemons have restarted and are operating normally
bigstart status httpd tomcat

Manual Verification and Rollback Procedures

After running the script, administrators should inspect the active Apache configuration:

BASH 
# Verify the presence of the mitigation include in httpd.conf
grep -E "proxy_ajp.conf" /etc/httpd/conf/httpd.conf

# Check Tomcat startup logs for clean initialization without errors
tail -n 50 /var/log/tomcat/catalina.out

If operational issues occur with legitimate administrative sessions, the script creates an automatic backup file (/etc/httpd/conf/httpd.conf.cve-2023-46747.bak), allowing rapid restoration followed by bigstart restart httpd tomcat.

Tier 2: Self IP Network Isolation & Port Lockdown Enforcement#

A foundational security principle for F5 BIG-IP architecture is the strict physical and logical separation of the Control Plane (Management) from the Data Plane (Traffic Processing).

Self IPs are IP addresses assigned to VLAN interfaces on the BIG-IP system used for routing application traffic. When a Self IP is configured with Port Lockdown: Allow Default, the system permits inbound TCP port 443 traffic, inadvertently exposing the TMUI management portal on user-facing and external interfaces.

Why 'Allow Default' Is Unsafe on Production Perimeters:

The Allow Default port lockdown profile permits a broad spectrum of listening services, including:

  • TCP port 443 (HTTPS Configuration Utility / TMUI)
  • TCP port 22 (SSH Management Access)
  • UDP port 53 (DNS Services)
  • UDP port 161 (SNMP Agent)
  • Protocol 89 (OSPF) and Protocol 179 (BGP)

On external, transit, or client-facing VLANs, exposing port 443 directly invites automated internet-wide scanning and exploitation. Setting Port Lockdown to allow-service none forces the BIG-IP kernel (Traffic Management Microkernel - TMM) to drop all incoming packets directed at the Self IP itself, while continuing to process and forward virtual server traffic destined for pool members normally.

Enforcing Port Lockdown via TMSH

Security engineers must reconfigure all Self IP addresses across all administrative partitions to enforce allow-service none:

BASH 
# Step 1: List all existing Self IPs across all partitions and review their active port lockdown settings
tmsh -q -c "cd /; list net self recursive allow-service"

# Step 2: Enforce 'allow-service none' across external, internal, and transit Self IPs
tmsh modify net self <external_self_ip_name> allow-service none
tmsh modify net self <internal_self_ip_name> allow-service none

# Step 3: If specific routing or health-check protocols are required, use custom port filters
# Example: Allow only OSPF (TCP 89) and BGP (TCP 179) while strictly denying TCP 443
tmsh modify net self <transit_self_ip_name> allow-service replace-all-with { tcp:179 ospf:0 }

# Step 4: Verify and commit configuration changes permanently to disk
tmsh save sys config

Tier 3: Management Plane Access Control Lists & Out-of-Band Network Architecture#

Access to the F5 BIG-IP Configuration Utility should be strictly confined to the dedicated physical management port (mgmt) connected to an isolated, out-of-band (OOB) network segment accessible only via secure bastion hosts or dedicated administrative jump boxes.

Restricting HTTPd Allowed IP Addresses

In addition to network routing boundaries, the Apache web server daemon on BIG-IP can enforce IP-based access control lists directly. This prevents unauthorized connections from untrusted IP ranges even if network firewall rules are misconfigured:

BASH 
# Step 1: Query current httpd IP access control list
tmsh list sys httpd allow

# Step 2: Restrict management access strictly to trusted administrative CIDR blocks
# Example: Allow only corporate NOC/SOC subnets and jump hosts
tmsh modify sys httpd allow replace-all-with { 10.240.10.0/24 192.168.100.50/32 }

# Step 3: Restrict SSH administrative access to the same secure subnets
tmsh modify sys sshd allow replace-all-with { 10.240.10.0/24 192.168.100.50/32 }

# Step 4: Verify and commit configuration
tmsh save sys config

High-Availability Cluster Considerations

When administering BIG-IP high-availability clusters, remember that sys httpd allow and net self settings must be mirrored on both cluster units. While network configuration objects sync via device groups, local Linux daemon configuration overrides applied via scripts do not propagate automatically across HA peers. Operators must explicitly execute remediation runbooks on every cluster member.

Dedicated Management Routing Domain

To prevent network packets originating from the management interface from inadvertently routing across public data plane interfaces, administrators should configure management routing domains or dedicated static management routes (tmsh modify sys management-route).

Tier 4: Edge WAF Signatures & BIG-IP ASM/Advanced WAF Custom Rules#

Organizations protecting external web assets with BIG-IP Application Security Manager (ASM), Advanced WAF (AWAF), or upstream cloud WAF providers (such as F5 Distributed Cloud Services) can deploy custom signatures to inspect and block AJP smuggling attempts before requests reach internal processing components.

WAF Signature Logic for AJP Request Smuggling:

  1. Detecting Binary AJP Magic Headers: Exploit payloads embed raw binary bytes within the HTTP request body. Inspecting the body for the AJP13 magic prefix \x12\x34\x00 effectively blocks binary injection.
  2. Denying Chunked Transfer-Encoding on Login Pages: Legitimate client interactions with /tmui/login.jsp do not use Transfer-Encoding: chunked. Any chunked POST request targeting login servlets should be dropped immediately.
  3. Restricting Internal Execution Paths: Block any external request attempting to access internal TMUI workspace endpoints directly (/tmui/locallb/workspace/*).
  4. Cloud WAAP Policy Enforcement: In distributed architectures, applying F5 Distributed Cloud WAAP policies at the edge ensures that unverified chunked payloads are stripped or inspected before hitting private data center interconnects.

Custom iRule for Perimeter Request Inspection:

TCL 
# iRule: Drop-AJP-Smuggling-Attempts
# Attach to public-facing virtual servers or management proxies
when HTTP_REQUEST {
    # 1. Block access to internal TMUI workspace execution scripts
    if { [HTTP::path] starts_with "/tmui/locallb/workspace/" } {
        log local0.warn "Security Alert: Blocked direct access to TMUI workspace from [IP::client_addr] targeting [HTTP::uri]"
        drop
        return
    }

    # 2. Block chunked requests directed at login servlets
    if { [HTTP::path] equals "/tmui/login.jsp" && [HTTP::header exists "Transfer-Encoding"] } {
        log local0.warn "Security Alert: Blocked chunked Transfer-Encoding on login portal from [IP::client_addr]"
        drop
        return
    }

    # 3. Trigger request body collection to inspect for binary AJP frames
    if { [HTTP::method] equals "POST" && [HTTP::header exists "Transfer-Encoding"] } {
        HTTP::collect 512
    }
}

when HTTP_REQUEST_DATA {
    # Inspect payload for binary AJP13 Magic Prefix: 0x12 0x34
    if { [HTTP::payload] contains "\x12\x34" } {
        log local0.alert "CRITICAL: Detected AJP Request Smuggling pattern (CVE-2023-46747) from [IP::client_addr]! Dropping connection."
        drop
        return
    }
}

Tier 5: Host OS & TMSH Auditing Architecture#

To establish comprehensive visibility into administrative operations and detect potential post-exploitation activity, blue teams must configure real-time log forwarding to enterprise SIEM platforms using BIG-IP's native High-Speed Logging (HSL) or syslog-ng daemon:

  1. Centralized Syslog Forwarding: Ensure all events logged to /var/log/httpd/access_log, /var/log/ltm, and /var/log/audit are forwarded immediately to central SIEM indexers.
  2. Automated Audit Alerting: Configure real-time SIEM alerts triggered by the string 01420002:5: AUDIT whenever user account provisioning (create auth user) or bash invocation occurs outside approved maintenance windows.
  3. File Integrity Monitoring (FIM): Implement periodic integrity checks across /config/bigip.conf, /etc/passwd, /etc/shadow, and /root/.ssh/authorized_keys to detect unauthorized modifications.
  4. Monitoring Ephemeral Directories: Attackers who obtain root bash access frequently stage automated reconnaissance tools, netcat binaries, or reverse shell scripts in /var/tmp/, /tmp/, or /shared/tmp/. Blue teams should establish cron monitors scanning these directories for non-standard ELF binaries.
  5. SNMP Trap Notifications: Configure custom alert handlers in /config/user_alert.conf to generate immediate SNMP traps or email notifications upon observing unauthorized configuration updates.

Production Detection Queries: Hunting AJP Smuggling & TMSH Abuse#

Because CVE-2023-46747 allows attackers to bypass authentication silently, threat hunting teams must correlate web server access logs with local system audit events to detect successful exploitation or pre-attack reconnaissance.

Detection Strategy 1: Production Sigma Rule for TMUI AJP Request Smuggling#

The following Sigma rule detects suspicious HTTP POST requests directed toward internal TMUI endpoints that should never receive direct client traffic:

YAML 
title: F5 BIG-IP TMUI AJP Smuggling Command Execution (CVE-2023-46747)
id: f5b1a3d2-8c4e-4f6a-9b1e-c2d4e6f8a0b2
status: production
description: Detects suspicious HTTP POST requests directed toward internal F5 BIG-IP TMUI execution endpoints (e.g., tmshCmd.jsp) indicative of CVE-2023-46747 AJP request smuggling exploitation.
references:
    - https://my.f5.com/manage/s/article/K000137353
    - https://nvd.nist.gov/vuln/detail/CVE-2023-46747
    - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/

logsource:
    product: f5
    service: tmui_httpd
detection:
    selection_endpoint:
        cs-method: 'POST'
        cs-uri-stem|contains:
            - '/tmui/locallb/workspace/tmshCmd.jsp'
            - '/tmui/locallb/workspace/fileRead.jsp'
            - '/tmui/locallb/workspace/directoryList.jsp'
            - '/mgmt/tm/util/bash'
    selection_status:
        sc-status:
            - 200
            - 302
            - 500
    filter_management_internal:
        c-ip:
            - '127.0.0.1'
            - '::1'
    condition: selection_endpoint and selection_status and not filter_management_internal
falsepositives:
    - Legitimate administrative workflows initiated from authorized internal network management consoles.
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - cve.2023_46747

Detection Strategy 2: Automated Forensic Log Audit Script#

Security analysts conducting post-incident analysis or proactive threat hunts can run the following Python script directly on the appliance or against ingested SIEM logs to identify indicators of compromise:

PYTHON 
#!/usr/bin/env python3
# Audit-F5-CVE-2023-46747.py
# Forensic script to detect exploitation traces of F5 BIG-IP CVE-2023-46747
import re
import os
import sys

ACCESS_LOG = "/var/log/httpd/access_log"
LTM_LOG = "/var/log/ltm"
AUDIT_LOG = "/var/log/audit"

print("[*] Starting F5 BIG-IP CVE-2023-46747 Forensic Audit...")

# 1. Audit Apache Access Logs for Smuggled Endpoint Requests
print(f"[*] Scanning {ACCESS_LOG} for unauthorized JSP execution...")
tmsh_pattern = re.compile(r'(?P<ip>\S+)\s+.*"POST\s+/tmui/locallb/workspace/(?P<jsp>\S+)\s+HTTP/.*"\s+(?P<status>\d+)')
anomalies_found = 0

if os.path.exists(ACCESS_LOG):
    with open(ACCESS_LOG, "r", encoding="utf-8", errors="ignore") as f:
        for line in f:
            match = tmsh_pattern.search(line)
            if match:
                data = match.groupdict()
                if data["ip"] not in ["127.0.0.1", "::1"]:
                    print(f"[!] CRITICAL ALERT: External IP {data['ip']} accessed {data['jsp']} (Status: {data['status']})")
                    anomalies_found += 1
else:
    print(f"[-] Log file {ACCESS_LOG} not found.")

# 2. Audit LTM Logs for Unauthorized TMSH User Creations
print(f"[*] Scanning {LTM_LOG} for suspicious tmsh account creation...")
user_create_pattern = re.compile(r'AUDIT\s+-\s+pid=\d+\s+user=\S+.*cmd_data=create\s+auth\s+user\s+(?P<user>\S+)\s+.*role\s+admin')

if os.path.exists(LTM_LOG):
    with open(LTM_LOG, "r", encoding="utf-8", errors="ignore") as f:
        for line in f:
            match = user_create_pattern.search(line)
            if match:
                data = match.groupdict()
                print(f"[!] CRITICAL COMPROMISE INDICATOR: Backdoor admin account created: '{data['user']}'")
                anomalies_found += 1
else:
    print(f"[-] Log file {LTM_LOG} not found.")

if anomalies_found == 0:
    print("[+] Forensic audit complete. Zero compromise indicators detected in checked logs.")
else:
    print(f"[!] AUDIT WARNING: Found {anomalies_found} suspicious events requiring immediate investigation!")

Enterprise Mitigation Matrix: Comparing Remediations for CVE-2023-46747#

The following comparative matrix evaluates defense-in-depth remediations for enterprise F5 BIG-IP platforms against CVE-2023-46747:

Remediation Strategy Architectural Layer Effectiveness vs CVE-2023-46747 Operational Impact & Outage Risk Deployment Complexity Verification Method
Official Software Hotfix System Software & Firmware Complete Resolution: Replaces vulnerable binaries, validates packet lengths, and secures AJP channel. Moderate-High (requires planned maintenance window, reboot, and cluster failover). Moderate (standard F5 base image and engineering hotfix ISO upgrade). Run tmsh show sys version to confirm patched build (e.g., 17.1.0.3+).
F5 Mitigation Script Web Server Configuration Complete Mitigation: Reconfigures Apache httpd to block unauthenticated AJP tunneling. Low (zero system reboot; briefly restarts httpd and tomcat daemons). Low (executable shell script run directly on active appliance). Verify presence of /config/httpd/conf.d/proxy_ajp.conf and test access.
Self IP Port Lockdown: None Network Data Plane Perimeter Neutralization: Blocks external network access to port 443 across client-facing interfaces. Low (prevents legitimate external management; zero impact on virtual servers). Low (configured via single TMSH command on all Self IPs). Run tmsh list net self allow-service to confirm allow-service none on all Self IPs.
Management ACLs & OOB VLAN Control Plane Security Access Restriction: Restricts TMUI management exclusively to authorized administrative jump hosts. Low (ensures administrators use designated secure management networks). Low-Moderate (requires network routing and firewall rule updates). Run tmsh list sys httpd allow and verify only trusted CIDRs are listed.
Custom WAF iRule / ASM Sig Application Gateway Layer Protocol Defense: Blocks binary AJP headers (\x12\x34) and chunked POSTs to login pages. Low (negligible latency overhead; requires monitoring for false positives). Moderate (deployed across public-facing virtual server listeners). Inspect ASM violation logs for signature triggers and test synthetic PoC payloads.
Automated Log Correlation SOC & Host Telemetry High Detection Fidelity: Surfaces anomalous tmshCmd.jsp access and backdoor user creations. Zero operational impact (passive monitoring of existing log files). Moderate (requires configuring remote syslog shipping to SIEM). Run Audit-F5-CVE-2023-46747.py and verify alert delivery to SOC dashboard.

Incident Response & Verification Playbook: Blue Team Containment & Auditing#

When monitoring systems detect anomalous access to /tmui/locallb/workspace/tmshCmd.jsp or when unpatched F5 BIG-IP appliances were exposed to untrusted networks, blue teams must execute the following structured incident response playbook.

Phase 1: Rapid Triage & Blast Radius Assessment#

  • Identify the Attacking Source IP: Extract the remote IP address, timestamp, and HTTP status code from /var/log/httpd/access_log.
  • Review TMSH Command Logs: Query /var/log/ltm and /var/log/audit around the timestamp of the event for AUDIT records executing create auth user, modify sys db, or bash execution via /mgmt/tm/util/bash.
  • Verify Authentication State of Target Endpoints: Confirm whether requests returned HTTP 200 OK or 403 Forbidden to establish whether authentication bypass was successful.
  • Isolate Compromised Management Interfaces: Immediately change the Self IP Port Lockdown setting to Allow None on the interface receiving the traffic, and restrict management access to trusted console subnets via tmsh modify sys httpd allow.
  • Preserve Ephemeral Forensic Artifacts: Dump volatile memory state, active connection tables (tmsh show sys connection), and open sockets (netstat -tulpn) before rebooting.

Phase 2: Containment & Workload Isolation#

  • Audit Local User Accounts in Configuration: Execute tmsh list auth user and compare the returned accounts against the authoritative baseline in /config/bigip.conf to identify unauthorized backdoor accounts.
  • Remove Rogue Accounts Immediately: Delete any identified backdoor administrative users using tmsh delete auth user <username> and save configuration (tmsh save sys config).
  • Inspect SSH Authorized Keys: Review /root/.ssh/authorized_keys and /home/*/.ssh/authorized_keys for unauthorized public keys injected by the adversary.
  • Audit Running Processes and Network Sockets: Execute ps aux and netstat -tulpn to check for unexpected reverse shells, netcat listeners, or rogue binaries executing out of /var/tmp/, /tmp/, or /shared/tmp/.
  • Audit Crontab Schedules: Inspect /etc/crontab and /var/spool/cron/ for scheduled tasks established by attackers for command persistence.

Phase 3: Eradication & Remediation Deployment#

  • Execute the F5 Mitigation Script Immediately: If an immediate software upgrade window is unavailable, run F5-Hotfix-CVE-2023-46747.sh in /var/tmp/ to terminate vulnerable AJP mappings.
  • Rotate System and Cryptographic Secrets:
    • Change passwords for the built-in admin and root accounts.
    • Rotate all Master Key passwords (f5mku -r <new_key>).
    • Re-issue SSL/TLS private keys and certificates stored in /config/filestore/ if full root compromise is suspected.
  • Deploy Hotfix Software Image: Upgrade the appliance to a patched maintenance build (e.g., 17.1.0.3+, 16.1.4.1+, or 15.1.10.2+) on an alternate boot location (tmsh install sys software image <image_name> volume HD1.2).

Phase 4: Recovery, Post-Incident Hardening & Verification#

  • Boot into Patched System Volume: Activate the patched volume (tmsh reboot volume HD1.2) during an approved maintenance window and verify cluster synchronization.
  • Verify Active Fix: Confirm that tmsh show sys version reflects the patched build and test that unauthenticated requests to /tmui/login.jsp cannot smuggle AJP frames.
  • Conduct Longitudinal SIEM Review: Ensure all Apache access logs, LTM logs, and audit logs are continuously forwarded to the enterprise SIEM via high-speed syslog (syslog-ng).
  • Implement Continuous Perimeter Attack Surface Management: Schedule external port scans to guarantee that port 443 management portals remain invisible on public Self IPs.

Executive Takeaway Table: Threat Vectors, Detection Signals, and Primary Mitigations#

The following executive reference summarizes the CVE-2023-46747 threat surface, primary detection indicators, and mandatory architectural controls:

Threat Vector / Phase Root Architectural Cause High-Fidelity Detection Signal Primary Blue Team Hardening Control
Exposed Management Port TMUI interface bound to external Self IPs with allow-service default or all. External scanning probes hitting /tmui/login.jsp in /var/log/httpd/access_log. Enforce Self IP Port Lockdown: Allow None; restrict management to dedicated OOB interface.
AJP Request Smuggling Desynchronization between mod_proxy_ajp and Tomcat over chunked body handling. External POST requests to /tmui/locallb/workspace/tmshCmd.jsp with HTTP 200 responses. Apply F5 engineering hotfix or execute F5-Hotfix-CVE-2023-46747.sh mitigation script.
Authentication Subversion Tomcat blindly trusts injected AJP req_attribute headers (remote_user=admin). Rapid execution of administrative actions without corresponding /tmui/login.jsp sessions. Restrict httpd access lists (tmsh modify sys httpd allow) to authorized management subnets.
Privileged User Creation Built-in tmshCmd.jsp endpoint executes arbitrary tmsh administrative commands. Log entry in /var/log/ltm showing AUDIT - cmd_data=create auth user <name> role admin. Deploy custom WAF signatures or iRules blocking binary AJP headers (\x12\x34) and workspace JSPs.
Root Shell Persistence Rogue admin accounts configured with shell bash allow interactive SSH logins. SSH login from unapproved IP in /var/log/audit; new keys in /root/.ssh/authorized_keys. Audit user accounts via tmsh list auth user, rotate master keys, and audit /config/bigip.conf.

Authoritative References & Further Reading#

  1. F5 Security Advisory: K000137353: BIG-IP Configuration utility unauthenticated remote code execution vulnerability CVE-2023-46747
    https://my.f5.com/manage/s/article/K000137353
  2. National Vulnerability Database (NVD): CVE-2023-46747 Detail — F5 BIG-IP Configuration Utility Authentication Bypass
    https://nvd.nist.gov/vuln/detail/CVE-2023-46747
  3. Praetorian Security Research: Refresh: Compromising F5 BIG-IP With Request Smuggling (CVE-2023-46747)
    https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
  4. CISA Known Exploited Vulnerabilities Catalog: CISA Adds CVE-2023-46747 to Known Exploited Vulnerabilities Catalog
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  5. MITRE ATT&CK Framework: Technique T1190: Exploit Public-Facing Application
    https://attack.mitre.org/techniques/T1190/

Comments

Post a Comment

Drag or use arrow keys to pan • Click outside or press Esc to close