F5 BIG-IP TMUI RCE
- Product
- F5 BIG-IP TMUI (Configuration utility)
- CVE
- CVE-2020-5902
- Disclosed
- 2020-07-01
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- BIG-IP 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, 11.6.1-11.6.5.1.
- Fixed
- 15.1.0.4, 14.1.2.6, 13.1.3.4, 12.1.5.2, 11.6.5.2.
Summary
Positive Technologies found that the BIG-IP Traffic Management User Interface could be reached without authentication through a path normalization flaw, exposing JSP pages that read files and run tmsh commands. Exploitation began within days of disclosure.
Root cause
Apache httpd and the backend Tomcat normalize the ';' path parameter differently. A path that Apache treats as the public login page is resolved by Tomcat to a protected JSP under /tmui/, skipping authentication and exposing file read/write and command execution functionality.
Impact
Unauthenticated code execution and full compromise of the load balancer and traffic it handles.
Detection
Search httpd logs for '..;' in /tmui/ paths. Nuclei template CVE-2020-5902.
Mitigation
Upgrade, and restrict TMUI to a dedicated management network; F5's httpd config mitigation blocks ';' in URLs.