CVE-2020-5902 PoC — F5 BIG-IP 路径遍历漏洞

Source

Associated Vulnerability

Readme

# CVE-2020-5902

```
   _______      ________    ___   ___ ___   ___         _____ ___   ___ ___  
  / ____\ \    / /  ____|  |__ \ / _ \__ \ / _ \       | ____/ _ \ / _ \__ \ 
 | |     \ \  / /| |__ ______ ) | | | | ) | | | |______| |__| (_) | | | | ) |
 | |      \ \/ / |  __|______/ /| | | |/ /| | | |______|___ \\__, | | | |/ / 
 | |____   \  /  | |____    / /_| |_| / /_| |_| |       ___) | / /| |_| / /_ 
  \_____|   \/   |______|  |____|\___/____|\___/       |____/ /_/  \___/____|
                                                                             
                                                                              
CVE-2020-5902-Scanner.py
@nsflabs
```   

The F5 BIG-IP Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability.

This vulnerability allows for unauthenticated attackers, or authenticated users, with network access to the TMUI, through the BIG-IP management port and/or Self IPs, to execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code. 

This is to test if a single remote system is vulnerable to cve-2020-5902.  

### Installation

```
$ git clone https://github.com/nsflabs/CVE-2020-5902.git
$ cd CVE-2020-5902/
$ pip3 install -r requirements.txt
```

### Usage
```
$ python3 cve-2020-5902_scanner.py targetip targetport
```

File Snapshot

 [4.0K]  /data/pocs/ced1c4d313ae6c1261a6663b996839a6ff76198c
├── [3.9K]  cve-2020-5902-Scanner.py
├── [1.4K]  README.md
└── [  17]  requirements.txt

0 directories, 3 files

Remarks