CVE-2024-23805
📋 TL;DR
This vulnerability allows undisclosed requests to cause the Traffic Management Microkernel (TMM) to terminate, leading to denial of service. It affects BIG-IP systems with specific configurations involving HTTP Analytics, Advanced WAF, or ASM profiles. The vulnerability requires non-default database variables to be enabled.
💻 Affected Systems
- F5 BIG-IP with Application Visibility and Reporting module
- F5 BIG-IP Advanced WAF
- F5 BIG-IP ASM
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
⚠️ Risk & Real-World Impact
Worst Case
Complete TMM termination causing service disruption for all traffic managed by the affected BIG-IP system, potentially leading to extended downtime.
Likely Case
Intermittent TMM crashes causing service interruptions and degraded performance for applications behind the virtual server.
If Mitigated
No impact if the vulnerable configuration is not present or if workarounds are implemented.
🎯 Exploit Status
The exact request pattern is undisclosed, but exploitation appears straightforward once known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check F5 advisory K000137334 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000137334
Restart Required: Yes
Instructions:
1. Review F5 advisory K000137334 for applicable fixed versions. 2. Schedule maintenance window. 3. Backup configuration. 4. Apply appropriate F5 software update. 5. Restart TMM services. 6. Verify functionality.
🔧 Temporary Workarounds
Disable vulnerable DB variables
allDisable the avr.IncludeServerInURI and avr.CollectOnlyHostnameFromURI database variables if not required.
tmsh modify sys db avr.IncludeServerInURI value false
tmsh modify sys db avr.CollectOnlyHostnameFromURI value false
Remove vulnerable profile configurations
allRemove HTTP Analytics profile with URLs enabled from virtual servers, or remove DoS/Bot Defense profiles if not essential.
tmsh list ltm virtual <virtual_server_name> profiles
tmsh modify ltm virtual <virtual_server_name> profiles remove { <analytics_profile_name> }
🧯 If You Can't Patch
- Implement workarounds to disable vulnerable DB variables or remove vulnerable profiles
- Implement network controls to limit traffic to affected virtual servers and monitor for TMM crashes
🔍 How to Verify
Check if Vulnerable:
Check if avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI are enabled: tmsh list sys db avr.IncludeServerInURI avr.CollectOnlyHostnameFromURI | grep valueCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify DB variables are disabled or system is updated to patched version and TMM remains stable under normal traffic.📡 Detection & Monitoring
Log Indicators:
- TMM termination/crash events in /var/log/ltm
- Unexpected service restarts
- Increased error rates on virtual servers
Network Indicators:
- Sudden loss of connectivity to applications behind BIG-IP
- Increased TCP resets or connection failures
SIEM Query:
source="/var/log/ltm" AND ("TMM" AND ("terminated" OR "crashed" OR "restarting"))