Point hosts at F5 BIG-IP Configuration Utility and flag CVE-2023-46748 (SQL injection) from a version compare plus time-based sleep confirm. Non-destructive.
Time-based sleep on the configuration utility. Advisory
Detect
Fingerprints BIG-IP and flags CVE-2023-46748 by version.
Report
Counts checked, product, affected, and confirmed.
Targets
Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Overview
This workflow finds F5 BIG-IP Configuration Utility and sorts each host by whether its version falls in the CVE-2023-46748 range. BIG-IP is often the last hop before production. CVE-2023-46748 is SQL injection in the configuration utility that CISA listed on KEV. The check reads TMUI login and flags the inclusive branch ranges the graph encodes. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public page (title match on BIG-IP), reads the version from /tmui/login.jsp with a fallback to the root body, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. CVE-2023-46748 is on CISA KEV (known exploited). Version flag is first. Hosts in range get a second node that only asks the configuration utility to sleep. It does not dump rows or write data.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as F5 BIG-IP Configuration Utility from the public page title, then GET /tmui/login.jsp and parse the version. A host counts as affected only when the fingerprint matches and the version is inside the encoded range.
Confirm only those flagged hosts with a time-based sleep on the configuration utility.
Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test. Fingerprint is read-only GET. Confirm is a sleep-only probe, and only after the version flag.
Outputs
results.jsonl. One row per host: URL, whether F5 BIG-IP Configuration Utility was detected, the version read, the affected flag, and whether the sleep confirm succeeded.
summary.json. Counts across the list: targets, product hits, affected, and errors.
Integrations
HTTP. Unauthenticated GET to the product root and /tmui/login.jsp. Confirm is a time-based sleep on the configuration utility of flagged hosts.
Sample output
The records below are illustrative and do not come from a real run. They show one F5 BIG-IP Configuration Utility host inside the CVE-2023-46748 range, one patched host, and one host that is not the product.
Which F5 BIG-IP Configuration Utility versions does this flag?
13.1.0 through 13.1.5, 14.1.0 through 14.1.5, 15.1.0 through 15.1.10, 16.1.0 through 16.1.4, and 17.1.0 through 17.1.1. Builds above those inclusive ceilings on each line is the floor the graph treats as not affected. The compare uses the version the product itself served.
Does a flagged host mean CVE-2023-46748 was exploited?
No. A flagged row is patch-lag against the range table. Confirm only asks the server to sleep. Treat a confirmed row as evidence the injection still answers, not as proof someone already used it.
Is this check safe on production?
Yes. Fingerprint is read-only GET. Confirm is a sleep-only probe, only on hosts already in range. It does not dump rows, write data, or create accounts.
Does the check need credentials?
No. It fingerprints the public page and reads /tmui/login.jsp the way an external scanner would.
What is CVE-2023-46748?
SQL injection in the F5 BIG-IP configuration utility. CISA listed it on KEV. This workflow flags by version, then confirms with a time-based sleep on the configuration utility.