---
id: 9306
title: "F5 BIG-IP Unauth RCE via AJP Smuggling (CVE-2023-46747) - Technical Analysis"
cve: CVE-2023-46747
source_domain: projectdiscovery.io
source_url: "https://projectdiscovery.io/blog/cve-2023-46747-5-big-ip-unauthenticated-rce-via-ajp-smuggling"
published_at: "2023-11-02T16:05:27Z"
tags: ["bug-bounty", "rce"]
phying_url: "https://phying.com/item/9306"
lang: en
---

# F5 BIG-IP Unauth RCE via AJP Smuggling (CVE-2023-46747) - Technical Analysis

## Summary

Description: CVE-2023-46747 is a critical vulnerability in the F5 BIG-IP Configuration Utility identified as a request smuggling bug within the Apache JServ Protocol (AJP). The flaw could potentially allow unauthenticated attackers with network access to the BIG-IP system through the management port and/or self-IP addresses to execute arbitrary system commands. This vulnerability was discovered and reported by Thomas Hendrickson and Michael Weber of Praetorian Security. It has a CVSS score of 9

## Intelligence Metadata

- **Sources:** projectdiscovery.io
- **CVE:** CVE-2023-46747
- **Published:** 2023-11-02T16:05:27Z
- **Original:** https://projectdiscovery.io/blog/cve-2023-46747-5-big-ip-unauthenticated-rce-via-ajp-smuggling
- **Phying News:** https://phying.com/item/9306