cbcvebase.
CVE-2023-46748
published 2023-10-26

CVE-2023-46748: An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the…

PriorityP184high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2023-11-21
Exploited in the wild
EPSS
4.47%
90.4th percentile
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected

125 ranges· showing 25
VendorProductVersion rangeFixed in
f5big-ip>= 13.1.0 < **
f5big-ip>= 14.1.0 < **
f5big-ip>= 15.1.0 < **
f5big-ip>= 16.1.0 < **
f5big-ip>= 17.1.0 < **
f5big-ip_aam
f5big-ip_access_policy_manager13.1.0 – 13.1.5
f5big-ip_access_policy_manager14.1.0 – 14.1.5
f5big-ip_access_policy_manager15.1.0 – 15.1.10
f5big-ip_access_policy_manager16.1.0 – 16.1.4
f5big-ip_access_policy_manager17.1.0 – 17.1.1
f5big-ip_advanced_firewall_manager13.1.0 – 13.1.5
f5big-ip_advanced_firewall_manager14.1.0 – 14.1.5
f5big-ip_advanced_firewall_manager15.1.0 – 15.1.10
f5big-ip_advanced_firewall_manager16.1.0 – 16.1.4
f5big-ip_advanced_firewall_manager17.1.0 – 17.1.1
f5big-ip_advanced_waf
f5big-ip_advanced_web_application_firewall13.1.0 – 13.1.5
f5big-ip_advanced_web_application_firewall14.1.0 – 14.1.5
f5big-ip_advanced_web_application_firewall15.1.0 – 15.1.10
f5big-ip_advanced_web_application_firewall16.1.0 – 16.1.4
f5big-ip_advanced_web_application_firewall17.1.0 – 17.1.1
f5big-ip_afm
f5big-ip_analytics
f5big-ip_analytics13.1.0 – 13.1.5

Detection & IOCsextracted from sources · hover to see the quote

path/var/log/tomcat/catalina.out
otherjava.sql.SQLException: Column not found: 0. {...) sh: no job control in this shell sh-4.2$ sh-4.2$ exit
  • Look for SQL injection exploitation evidence in the Tomcat log file /var/log/tomcat/catalina.out; the specific pattern includes a SQLException followed by shell spawn indicators ('sh: no job control in this shell', 'sh-4.2$'), confirming arbitrary OS command execution via the SQL injection.
  • CVE-2023-46748 is actively chained with CVE-2023-46747 (auth bypass, CVSS 9.8); detecting exploitation of either vulnerability should trigger investigation for both, as threat actors use them in combination.
  • Attackers actively erase forensic traces on compromised BIG-IP devices; absence of log evidence does NOT confirm a clean system — treat any unpatched, exposed BIG-IP as potentially compromised.
  • Monitor network access to the BIG-IP Configuration utility via the management port and self IP addresses for authenticated sessions performing unusual or unexpected requests, as the attack vector requires network access through these interfaces.
  • ·Not all exploited systems will exhibit the same IoCs; a skilled attacker may remove all traces of compromise, making log-based detection unreliable as a sole indicator.
  • ·Software versions that have reached End of Technical Support (EoTS) are not evaluated for this CVE; detections should account for the fact that EoTS devices may be vulnerable but are not covered by vendor advisories.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.