F5 TMUI Remote Code Execution Vulnerability (CVE-2020-5902) Exploitation Attempts

This brief focuses on detecting exploitation attempts of CVE-2020-5902, a remote code execution (RCE) vulnerability in the Traffic Management User Interface (TMUI) of F5 BIG-IP, BIG-IQ, and Traffix SDC devices. The vulnerability allows unauthenticated attackers to execute arbitrary commands on the affected devices. Detection relies on identifying specific patterns in syslog data indicative of exploit attempts, including "hsqldb;" and directory traversal sequences ("..;"). Successful exploitation can lead to full system compromise, unauthorized access, data exfiltration, and lateral movement within the network. The exploitation activity is significant because these F5 devices are often critical network infrastructure components.

Attack Chain

1. An unauthenticated attacker sends a malicious HTTP request to the TMUI interface of an F5 BIG-IP, BIG-IQ, or Traffix SDC device.
2. The request contains a crafted URL with directory traversal sequences ("..;") designed to bypass authentication and access restricted resources.
3. The request includes the "hsqldb;" string, used to exploit a Java deserialization vulnerability within the TMUI.
4. The vulnerable component processes the malicious request without proper sanitization or validation.
5. The directory traversal allows the attacker to access and modify sensitive files or execute commands within the context of the TMUI application.
6. The "hsqldb;" payload triggers the execution of arbitrary Java code, allowing the attacker to gain full control of the system.
7. The attacker installs a backdoor or establishes a reverse shell to maintain persistent access.
8. The attacker performs reconnaissance, steals sensitive data, or uses the compromised system as a pivot point for further attacks within the network.

Impact

Successful exploitation of CVE-2020-5902 allows attackers to execute arbitrary commands on affected F5 devices. This can result in complete system compromise, leading to unauthorized access to sensitive data, data exfiltration, or further lateral movement within the network. Given that F5 devices are often critical network infrastructure components, a successful attack can have a significant impact on the confidentiality, integrity, and availability of network services.

Recommendation

• Deploy the Sigma rule "Detect F5 TMUI RCE CVE-2020-5902 Exploitation Attempts via Syslog" to detect exploit attempts based on syslog data.
• Deploy the Sigma rule "Detect F5 TMUI RCE CVE-2020-5902 Exploitation Attempts via Web Logs" to detect exploit attempts based on web server logs.
• Ingest logs via syslog from F5 BIG-IP, BIG-IQ, and Traffix SDC devices to ensure coverage, as recommended in the "How to Implement" section.
• Investigate and remediate any detected exploitation attempts immediately.
• Refer to F5's advisory (https://support.f5.com/csp/article/K52145254) for patching and mitigation guidance.