CVE-2023-41373: F5 BIG-IP APM Path Traversal Flaw

CVE-2023-41373 Overview

A directory traversal vulnerability exists in the F5 BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. This vulnerability is particularly severe for BIG-IP systems running in Appliance mode, where a successful exploit can allow the attacker to cross a security boundary. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact

Authenticated attackers can leverage directory traversal to execute arbitrary commands on vulnerable BIG-IP systems, with the potential to cross security boundaries in Appliance mode deployments.

Affected Products

• F5 BIG-IP Access Policy Manager
• F5 BIG-IP Advanced Firewall Manager
• F5 BIG-IP Application Security Manager
• F5 BIG-IP Domain Name System
• F5 BIG-IP Local Traffic Manager
• F5 BIG-IP Advanced Web Application Firewall
• F5 BIG-IP Analytics
• F5 BIG-IP Application Acceleration Manager
• F5 BIG-IP Application Visibility and Reporting
• F5 BIG-IP Carrier-Grade NAT
• F5 BIG-IP DDoS Hybrid Defender
• F5 BIG-IP Fraud Protection Service
• F5 BIG-IP Global Traffic Manager
• F5 BIG-IP Link Controller
• F5 BIG-IP Policy Enforcement Manager
• F5 BIG-IP SSL Orchestrator
• F5 BIG-IP WebAccelerator
• F5 BIG-IP WebSafe

Discovery Timeline

• October 10, 2023 - CVE-2023-41373 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-41373

Vulnerability Analysis

This directory traversal vulnerability resides within the BIG-IP Configuration Utility, a web-based management interface used for administering F5 BIG-IP appliances. The vulnerability allows an authenticated attacker to manipulate file path inputs to access files and directories outside the intended restricted directory structure. By exploiting this flaw, an attacker can traverse the file system and ultimately execute commands on the underlying BIG-IP system.

The attack requires network access and low-privilege authentication credentials to the Configuration Utility. Once authenticated, the attacker can craft malicious requests containing path traversal sequences (such as ../) to escape the intended directory boundaries. The impact is particularly severe on systems running in Appliance mode, as successful exploitation can breach the security isolation boundaries that Appliance mode is designed to enforce.

Root Cause

The root cause of this vulnerability is improper input validation in the BIG-IP Configuration Utility. The application fails to adequately sanitize user-supplied path inputs before using them to access files on the system. This allows attackers to inject directory traversal sequences that navigate outside the intended directory structure, ultimately reaching sensitive system files and enabling command execution.

Attack Vector

The attack is executed over the network against the BIG-IP Configuration Utility web interface. An attacker must first obtain valid authentication credentials (even low-privileged ones) to access the Configuration Utility. Once authenticated, the attacker can submit specially crafted requests containing directory traversal sequences to access arbitrary files on the system.

The exploitation path typically involves manipulating file path parameters within the Configuration Utility's functionality, using sequences like ../ or URL-encoded equivalents (%2e%2e%2f) to traverse upward through the directory structure and reach sensitive system locations where command execution becomes possible.

Detection Methods for CVE-2023-41373

Indicators of Compromise

• Unusual requests to the BIG-IP Configuration Utility containing path traversal sequences such as ../, ..%2f, or %2e%2e/
• Authentication logs showing successful logins followed by suspicious file access patterns
• Web server logs containing requests with abnormally long file paths or multiple parent directory references
• Unexpected command execution or process spawning on the BIG-IP system following Configuration Utility access

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block requests containing directory traversal patterns targeting the Configuration Utility
• Implement log monitoring for HTTP requests containing path traversal signatures such as ../, encoded variants, and unusually long path strings
• Enable detailed audit logging on BIG-IP systems to track file system access and command execution
• Use SentinelOne Singularity to monitor for behavioral anomalies indicating post-exploitation activity

Monitoring Recommendations

• Continuously monitor BIG-IP Configuration Utility access logs for suspicious request patterns
• Alert on any authenticated sessions that attempt to access files outside expected directory boundaries
• Establish baseline behavior for Configuration Utility usage and alert on deviations
• Monitor for unexpected process creation or command execution on BIG-IP systems

How to Mitigate CVE-2023-41373

Immediate Actions Required

• Apply the security patches provided by F5 as documented in their security advisory
• Restrict network access to the BIG-IP Configuration Utility to trusted management networks only
• Review and audit all accounts with access to the Configuration Utility, removing unnecessary privileges
• Enable enhanced logging to detect any exploitation attempts

Patch Information

F5 has released security updates to address this vulnerability. Organizations should consult the F5 Technical Article K000135689 for specific version information and patching guidance. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated and may remain vulnerable.

Workarounds

• Implement strict network segmentation to limit access to the BIG-IP Configuration Utility to authorized management networks only
• Use firewall rules or access control lists to restrict which IP addresses can reach the Configuration Utility
• Consider disabling the Configuration Utility entirely if not required for operations, using CLI-based management instead
• Deploy additional monitoring and alerting for Configuration Utility access patterns while awaiting patch deployment

# Restrict Configuration Utility access to management network
# Example: Modify httpd configuration to limit access
# Consult F5 documentation for proper implementation

# Check current BIG-IP version
tmsh show sys version

# Review security advisory for patch applicability
# https://my.f5.com/manage/s/article/K000135689