F5 BIG-IP Configuration Utility Authenticated SQL Injection and Remote Code Execution (RCE) Vulnerability (CVE-2023-46748) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-46748) is an authenticated SQL injection (SQLi) vulnerability residing in the F5 BIG-IP Configuration Utility (commonly known as TMUI). The root cause is insufficient input validation within specific API endpoints of the web management interface. Although authentication is required, low-privileged users can exploit this flaw to gain unauthorized database access and control.

2. Exploitation Mechanics & Attack Scenario

An attacker authenticated to the Configuration Utility sends a crafted HTTP request containing malicious SQL payloads to the vulnerable endpoint. By leveraging SQL injection, the attacker can manipulate the underlying database. Due to the architecture of BIG-IP, database manipulation can be escalated to execute arbitrary shell commands on the underlying Linux operating system with root privileges. Notably, this vulnerability has been observed in active exploit chains alongside authentication bypass flaws (such as CVE-2023-46747) to achieve unauthenticated RCE.

3. Infrastructure & Business Impact

This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Successful exploitation grants full administrative control over the BIG-IP appliance, allowing attackers to decrypt network traffic, steal SSL certificates/API keys, and pivot deeper into the internal corporate network, posing a catastrophic risk to business continuity.