pentester.land· Oct 26, 2023· by Michael Weber (@BouncyHat), Thomas Hendrickson🔍 CVE-2023-46747

Refresh: Compromising F5 BIG-IP With Request Smuggling | CVE-2023-46747

Target Program: F5

🎯 Vulnerability: Remote Code Execution (RCE)

💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.

#HTTP request smuggling#Authentication bypass#RCE#Apache JServ Protocol (AJP)#CVE-2023-46747