F5 BIG-IP Webserver RCE exploitation attempts via POST to /mgmt/tm/util/bash
Alerts on POST requests to /mgmt/tm/util/bash containing tmui Control/form parameters consistent with CVE-2023-46747 exploitation attempts.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-11-08
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags webserver traffic that uses an HTTP POST request with a URI stem containing /mgmt/tm/util/bash and includes specific form-related parameters in the request body. This pattern is indicative of exploitation attempts targeting an unauthenticated remote code execution condition on F5 BIG-IP. The detection relies on webserver request telemetry, specifically the HTTP method, URI stem, and observable request body content (both plain and hex-encoded keyword sequences).
Reporting behind it
- github.comhttps://github.com/AliBrTab/CVE-2023-46747-POC/tree/main
- github.comhttps://github.com/0xorOne/nuclei-templates/blob/2fef4270ec6e5573d0a1732cb18bcfc4b1580a88/http/cves/2023/CVE-2023-46747.yaml
- mp.weixin.qq.comhttps://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
- praetorian.comhttps://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-46747/web_cve_2023_46747_f5_remote_code_execution.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: F5 BIG-IP Webserver RCE exploitation attempts via POST to /mgmt/tm/util/bash
id: ee7a1d8e-e93c-4c36-92ce-0760125ce007
related:
- id: f195b2ff-e542-41bf-8d91-864fb81e5c20
type: similar
- id: e9928831-ba14-42ea-a4bc-33d352b9929a
type: derived
status: test
description: This rule flags webserver traffic that uses an HTTP POST request with a URI stem containing /mgmt/tm/util/bash and includes specific form-related parameters in the request body. This pattern is indicative of exploitation attempts targeting an unauthenticated remote code execution condition on F5 BIG-IP. The detection relies on webserver request telemetry, specifically the HTTP method, URI stem, and observable request body content (both plain and hex-encoded keyword sequences).
references:
- https://github.com/AliBrTab/CVE-2023-46747-POC/tree/main
- https://github.com/0xorOne/nuclei-templates/blob/2fef4270ec6e5573d0a1732cb18bcfc4b1580a88/http/cves/2023/CVE-2023-46747.yaml
- https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
- https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-46747/web_cve_2023_46747_f5_remote_code_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-08
tags:
- attack.initial-access
- attack.t1190
- cve.2023-46747
- detection.emerging-threats
logsource:
category: webserver
definition: "Requirements: The POST request body data must be collected in order to make use of this detection"
detection:
selection:
cs-method: POST
cs-uri-stem|contains: /mgmt/tm/util/bash
keywords_hex:
"|all":
- 2f746d75692f436f6e74726f6c2f666f726d
- 666f726d5f706167653d253266746d756925326673797374656d253266757365722532666372656174652e6a7370
keywords_plain:
"|all":
- /tmui/Control/form
- form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp
condition: selection and (keywords_hex or keywords_plain)
falsepositives:
- Unlikely
level: high
license: DRL-1.1