schoi1337/cve-2025-20029-simulationSimulated environment for CVE-2025-20029 using Docker. Includes PoC and auto-reporting.
⚠️ This repository simulates CVE-2025-20029 in a safe and controlled environment.
It does not interact with real F5 BIG-IP systems or exploit any production service.
The goal is educational: to study the vulnerability pattern and test payloads safely.
CVE-2025-20029 is a high-severity command injection vulnerability affecting F5 BIG-IP systems.
The issue resides in the iControl REST API, which, under certain configurations, allows an authenticated user to execute arbitrary system commands via the /mgmt/tm/util/bash endpoint.
This simulation demonstrates how the vulnerability could be exploited in a controlled, containerized environment.
The exploit/exploit.py script simulates a remote code execution scenario by sending a crafted JSON payload to the vulnerable F5 BIG-IP endpoint /mgmt/tm/util/bash.
Key functionalities:
{"command": "id"}bashThis script is intentionally minimal to make the exploit path transparent and easily modifiable.
It is ideal for testing, replaying the attack vector, or incorporating into training labs.
This project does not:
Instead, it focuses on:
replay.sh)report.md)meta.yamlcd CVE-2025-20029
# Make scripts executable
chmod +x replay.sh
# Run the exploit + generate Markdown report
sudo ./replay.sh
.
├── app.py # Flask mock app simulating vulnerable endpoint
├── Dockerfile
├── docker-compose.yml
├── replay.sh
├── report.md / # Auto-generated report
├── exploit/
│ └── exploit.py
├── logs/
│ └── run1.log
├── meta.yaml
├── detection.md
├── remediation.md
├── utils/
│ ├── report_generator.py
CVE: CVE-2025-20029
This simulation was inspired by public research on CVE-2025-20029:
💡 Note The implementation here is not a 1:1 copy of any production environment, but a minimal, educational mock-up using Flask and Docker to safely demonstrate the core logic of the vulnerability.