Three days after an advisory was disclosed for a critical remote code execution vulnerability in F5’s BIG-IP, active attempts to exploit vulnerable hosts have been observed in the wild. Update July 8, 2020: F5 has provided updated mitigation details after reports that researchers had discovered a way to bypass some of the mitigations. The Solutions section of our blog has been updated accordingly.

CVE-2020-5902: Critical Vulnerability in F5 BIG-IP Traffic Management User Interface (TMUI) Actively Exploited

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

A remote code execution vulnerability exists in Traffic Management User Interface (TMUI), also referred to as the Configuration utility. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.

Note: An initial mitigation for this vulnerability was released by the vendor, which can be bypassed.
This plugin also tests for the bypass of that initial mitigation.

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.2 / 12.1.5.2 / 13.1.3.4 / 14.1.2.6 / 15.0.1.4 / 15.1.0.4 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K52145254 advisory.

  - In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and     11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration     utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. (CVE-2020-5902)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
138140	F5 Networks BIG-IP : TMUI RCE (CVE-2020-5902) (Direct Check)	Nessus	CGI abuses	Remote	critical
137918	F5 Networks BIG-IP : TMUI RCE vulnerability (K52145254)	Nessus	F5 Networks Local Security Checks	Local	critical

Detections

Analytics

CVE-2020-5902

critical

Tenable Plugins

critical

critical