CVE-2023-41373

Q: What is the severity of CVE-2023-41373?

CVE-2023-41373 has a CVSS score of 9.9 (CRITICAL). This CVE describes a directory traversal vulnerability in the BIG-IP Configuration Utility that allows authenticated attackers to execute arbitrary commands on the BIG-IP system. In Appliance mode, successful exploitation can allow attackers to cross security boundaries. This affects F5 BIG-IP systems with vulnerable versions of the Configuration Utility.

9.9 CRITICAL

Remote Code Execution

📋 TL;DR

This CVE describes a directory traversal vulnerability in the BIG-IP Configuration Utility that allows authenticated attackers to execute arbitrary commands on the BIG-IP system. In Appliance mode, successful exploitation can allow attackers to cross security boundaries. This affects F5 BIG-IP systems with vulnerable versions of the Configuration Utility.

💻 Affected Systems

Products:

F5 BIG-IP

Versions: Specific versions listed in F5 advisory K000135689 (typically multiple versions before the fix)

Operating Systems: F5 TMOS

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated access to the BIG-IP Configuration Utility. Appliance mode exploitation allows crossing security boundaries.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with root-level command execution, allowing attackers to steal sensitive data, deploy ransomware, pivot to other network segments, and maintain persistent access.

🟠

Likely Case

Authenticated attackers gaining command execution capabilities to exfiltrate configuration data, modify network settings, or deploy backdoors for future access.

🟢

If Mitigated

Limited impact due to network segmentation, strong authentication controls, and monitoring that detects and blocks exploitation attempts.

🌐 Internet-Facing: HIGH

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Requires authenticated access but directory traversal to command execution is straightforward once authenticated.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Refer to F5 advisory K000135689 for specific fixed versions

Vendor Advisory: https://my.f5.com/manage/s/article/K000135689

Restart Required: Yes

Instructions:

1. Review F5 advisory K000135689 for affected versions. 2. Upgrade to fixed versions per F5's guidance. 3. Apply patches during maintenance windows. 4. Restart BIG-IP services as required. 5. Verify the fix using version checks.

🔧 Temporary Workarounds

Restrict Configuration Utility Access

all

Limit access to the BIG-IP Configuration Utility to only trusted administrative networks and users.

Configure network ACLs to restrict access to BIG-IP management interfaces
Implement strong authentication and MFA for all administrative accounts

Network Segmentation

all

Isolate BIG-IP management interfaces from general network traffic.

Implement VLAN segmentation for management networks
Configure firewall rules to restrict management traffic

🧯 If You Can't Patch

Implement strict network access controls to limit BIG-IP Configuration Utility access to only necessary administrative IPs
Enable detailed logging and monitoring for Configuration Utility access and file system operations

🔍 How to Verify

Check if Vulnerable:

Check your BIG-IP version against the affected versions listed in F5 advisory K000135689

Check Version:

tmsh show sys version

Verify Fix Applied:

Verify BIG-IP version is updated to a fixed version listed in the F5 advisory

📡 Detection & Monitoring

Log Indicators:

Unusual file path access patterns in Configuration Utility logs
Unexpected command execution events
Authentication attempts followed by directory traversal patterns

Network Indicators:

Unusual traffic to BIG-IP management interfaces from unexpected sources
Patterns of directory traversal attempts in HTTP requests

SIEM Query:

source="bigip_logs" AND ("directory traversal" OR "path traversal" OR "../" patterns in URI)

📊 Metadata

CVE ID: CVE-2023-41373

CVSS v3 Score: 9.9 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-22

Published: October 10, 2023

Last Updated: November 21, 2024

🔗 References

https://my.f5.com/manage/s/article/K000135689 Vendor Advisory
https://my.f5.com/manage/s/article/K000135689 Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Access Policy Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Firewall Manager by F5

Big Ip Advanced Web Application Firewall by F5

Big Ip Advanced Web Application Firewall by F5

Big Ip Advanced Web Application Firewall by F5

Big Ip Advanced Web Application Firewall by F5

Big Ip Advanced Web Application Firewall by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Analytics by F5

Big Ip Application Acceleration Manager by F5

Big Ip Application Acceleration Manager by F5

Big Ip Application Acceleration Manager by F5

Big Ip Application Acceleration Manager by F5

Big Ip Application Acceleration Manager by F5

Big Ip Application Security Manager by F5

Big Ip Application Security Manager by F5

Big Ip Application Security Manager by F5

Big Ip Application Security Manager by F5

Big Ip Application Security Manager by F5

Big Ip Application Visibility And Reporting by F5

Big Ip Application Visibility And Reporting by F5

Big Ip Application Visibility And Reporting by F5

Big Ip Application Visibility And Reporting by F5

Big Ip Application Visibility And Reporting by F5

Big Ip Carrier Grade Nat by F5

Big Ip Carrier Grade Nat by F5

Big Ip Carrier Grade Nat by F5

Big Ip Carrier Grade Nat by F5

Big Ip Carrier Grade Nat by F5

Big Ip Ddos Hybrid Defender by F5

Big Ip Ddos Hybrid Defender by F5

Big Ip Ddos Hybrid Defender by F5

Big Ip Ddos Hybrid Defender by F5

Big Ip Ddos Hybrid Defender by F5

Big Ip Domain Name System by F5

Big Ip Domain Name System by F5

Big Ip Domain Name System by F5

Big Ip Domain Name System by F5

Big Ip Domain Name System by F5

Big Ip Fraud Protection Service by F5

Big Ip Fraud Protection Service by F5

Big Ip Fraud Protection Service by F5

Big Ip Fraud Protection Service by F5

Big Ip Fraud Protection Service by F5

Big Ip Global Traffic Manager by F5

Big Ip Global Traffic Manager by F5

Big Ip Global Traffic Manager by F5

Big Ip Global Traffic Manager by F5

Big Ip Global Traffic Manager by F5

Big Ip Link Controller by F5

Big Ip Link Controller by F5

Big Ip Link Controller by F5

Big Ip Link Controller by F5

Big Ip Link Controller by F5

Big Ip Local Traffic Manager by F5

Big Ip Local Traffic Manager by F5

Big Ip Local Traffic Manager by F5

Big Ip Local Traffic Manager by F5

Big Ip Local Traffic Manager by F5

Big Ip Policy Enforcement Manager by F5

Big Ip Policy Enforcement Manager by F5

Big Ip Policy Enforcement Manager by F5

Big Ip Policy Enforcement Manager by F5

Big Ip Policy Enforcement Manager by F5

Big Ip Ssl Orchestrator by F5

Big Ip Ssl Orchestrator by F5