F5 BIG-IP Webserver RCE Exploit Indicators (POST /mgmt/tm/util/bash and tmui form payload)

Alerts on POST requests to /mgmt/tm/util/bash containing tmui Control/form parameters consistent with CVE-2023-46747 exploitation attempts.

FreeUnreviewedSigmahighv1

f5-big-ip-webserver-rce-exploit-indicators-post-mgmt-tm-util-bash-and-tmui-form--e9928831

title: F5 BIG-IP Webserver RCE Exploit Indicators (POST /mgmt/tm/util/bash and tmui form payload)
id: ee7a1d8e-e93c-4c36-92ce-0760125ce007
related:
  - id: f195b2ff-e542-41bf-8d91-864fb81e5c20
    type: similar
  - id: e9928831-ba14-42ea-a4bc-33d352b9929a
    type: derived
status: test
description: This rule flags webserver POST requests that target a bash utility path on F5 BIG-IP and contain specific tmui control/form parameters used to create user functionality. Such requests can indicate unauthenticated remote code execution exploitation attempts against exposed BIG-IP management interfaces. The detection relies on HTTP telemetry capturing request method, URI stem, and either hex-encoded or plain-text keyword sequences in the POST body.
references:
  - https://github.com/AliBrTab/CVE-2023-46747-POC/tree/main
  - https://github.com/0xorOne/nuclei-templates/blob/2fef4270ec6e5573d0a1732cb18bcfc4b1580a88/http/cves/2023/CVE-2023-46747.yaml
  - https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
  - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-46747/web_cve_2023_46747_f5_remote_code_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-08
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-46747
  - detection.emerging-threats
logsource:
  category: webserver
  definition: "Requirements: The POST request body data must be collected in order to make use of this detection"
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains: /mgmt/tm/util/bash
  keywords_hex:
    "|all":
      - 2f746d75692f436f6e74726f6c2f666f726d
      - 666f726d5f706167653d253266746d756925326673797374656d253266757365722532666372656174652e6a7370
  keywords_plain:
    "|all":
      - /tmui/Control/form
      - form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp
  condition: selection and (keywords_hex or keywords_plain)
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags webserver POST requests that target a bash utility path on F5 BIG-IP and contain specific tmui control/form parameters used to create user functionality. Such requests can indicate unauthenticated remote code execution exploitation attempts against exposed BIG-IP management interfaces. The detection relies on HTTP telemetry capturing request method, URI stem, and either hex-encoded or plain-text keyword sequences in the POST body.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.