F5 BIG-IP Exploit Attempt - CVE-2023-46747

BIG-IP is a collection of hardware and software solutions that direct traffic across a network. BIG-IP appliances provide a Configuration Utility web interface known as the Traffic Management User Interface (TMUI). TMUI forwards HTTP requests over the Apache JServe Protocol (AJP). A request smuggling vulnerability in the TMUI will mishandle HTTP requests sent between an Apache HTTP front-end server and an AJP back-end server, leading to authentication bypass. To exploit this vulnerability, the attacker creates an HTTP POST request with a manipulated Transfer-Encoding header, a malicious AJP message in the POST body, and a URL with /tmui/login.jsp. The TMUI forwards the POST request and the smuggled AJP message to the back-end server for processing, which interprets the AJP message in the POST body as another forwarded POST request. After a successful exploit, the attacker can chain together multiple requests to eventually send an HTTP POST request to the /mgmt/tm/util/bash endpoint, which leads to remote code execution.