CVE-2020-5902

CVE-2020-5902: F5 BIG-IP TMUI Path Traversal Leading to Remote Code Execution

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2020-5902 is a critical unauthenticated remote code execution vulnerability in the F5 BIG-IP Traffic Management User Interface (TMUI), also known as the Configuration utility. The flaw is rooted in a path traversal weakness (CWE-22) within undisclosed pages of the TMUI. An attacker can leverage this directory traversal to access restricted files and, under certain conditions, achieve remote code execution on the underlying system. The vulnerability requires no authentication, has low attack complexity, and is exploitable over the network, making it one of the most severe and widely exploited infrastructure vulnerabilities of 2020.

Background

F5 BIG-IP is a widely deployed family of application delivery and security platforms used by enterprises and service providers to manage traffic, load balancing, SSL offloading, web application firewalling, and access policy enforcement. The TMUI is the web-based administrative interface used to configure and monitor BIG-IP devices. Because it is typically exposed to network segments where administrators operate, any unauthenticated vulnerability in this interface represents a severe risk to the confidentiality, integrity, and availability of not only the BIG-IP appliance but also the applications and services it fronts.

Root Cause

The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). The TMUI fails to adequately sanitize user-supplied path components in requests to certain internal endpoints. This allows an attacker to inject directory traversal sequences (such as ../ or equivalent encoded forms) to escape the intended web root and access files or functionality outside the restricted scope. In the context of the TMUI's architecture, this path traversal can be chained with other application behaviors to read arbitrary files from the filesystem or trigger server-side processing that leads to remote code execution. The vulnerability is present in the TMUI's handling of requests to undisclosed pages that trust client-supplied path data without proper validation or canonicalization.

Impact

The CVSS v3 score of 9.8 and CVSS v2 score of 10.0 reflect the maximum possible severity:

• Network Attack Vector (AV:N): The vulnerability is exploitable remotely over the network.
• Low Attack Complexity (AC:L): No special conditions or advanced techniques are required.
• No Privileges Required (PR:N): The attacker does not need any account or credentials.
• No User Interaction (UI:N): The attack can be fully automated without victim interaction.
• Complete Confidentiality, Integrity, and Availability Impact: Successful exploitation grants the attacker the ability to read sensitive data, modify system configurations, and execute arbitrary commands, effectively compromising the entire appliance.

Because BIG-IP devices often sit at the edge of networks and process sensitive traffic, a successful attack can pivot to backend applications, decrypt TLS traffic, or disrupt service availability at scale.

Exploitation Walkthrough

Ethics and Legal Notice: The following is a generic, defensive description of the attack mechanism. No weaponized exploit code is provided. Testing for this vulnerability on systems you do not own or have explicit permission to test is illegal and unethical.

The exploitation generally follows these stages:

1. Reconnaissance: The attacker identifies a BIG-IP device with an exposed TMUI (typically over HTTPS on port 443 or port 8443).
2. Path Traversal Probe: The attacker sends a crafted HTTP request to a TMUI endpoint that embeds directory traversal sequences in the URL path or parameters. The application fails to normalize the path, allowing access to restricted backend resources.
3. File Access: The attacker may use the traversal to read sensitive files from the BIG-IP filesystem, such as configuration files, SSL certificates, or password hashes, which can be used for further compromise.
4. Code Execution: By chaining the traversal with TMUI-specific endpoints that allow file uploads or script execution, the attacker can achieve remote code execution on the host operating system.

Because the attack is unauthenticated and network-accessible, mass-scanning campaigns and automated exploitation were observed in the wild shortly after disclosure.

Affected and Patched Versions

The following BIG-IP version ranges are affected according to the official source data:

• 15.x: 15.0.0 through 15.1.0.3
• 14.x: 14.1.0 through 14.1.2.5
• 13.x: 13.1.0 through 13.1.3.3
• 12.x: 12.1.0 through 12.1.5.1
• 11.x: 11.6.1 through 11.6.5.1

Affected modules include BIG-IP Access Policy Manager, Advanced Firewall Manager, Advanced Web Application Firewall, Analytics, Application Acceleration Manager, Application Security Manager, DDoS Hybrid Defender, DNS, Fraud Protection Service, Global Traffic Manager, Link Controller, Local Traffic Manager, Policy Enforcement Manager, and SSL Orchestrator.

Patched Versions: The source data does not enumerate specific fixed releases. Administrators should consult F5 security advisory K52145254 for the definitive list of patched versions and available hotfixes.

Remediation

1. Upgrade Immediately: Apply the patched software versions or hotfixes provided by F5 for your specific BIG-IP branch. Prioritize any TMUI interfaces exposed to untrusted networks.
2. Restrict Network Access: Limit TMUI access to dedicated management interfaces and restrict source IP addresses to trusted administrative hosts only. Do not expose the TMUI to the public internet.
3. Implement Firewall Rules: Use upstream firewalls or ACLs to block unauthorized access to the TMUI ports from external or untrusted network segments.
4. Monitor for Compromise: Review BIG-IP device logs for unauthorized access, unexpected file modifications, or new administrative accounts. Scan for indicators of compromise (IoCs) published by F5 and security researchers.
5. Compensating Controls: If patching is delayed, consider disabling the TMUI temporarily (if operationally feasible) or placing the device behind a strict reverse proxy with path-filtering rules to block known traversal patterns. Note that this is a temporary measure and does not replace patching.

Detection

Defenders can detect exploitation and post-exploitation activity through several methods:

• Web Server Logs: Look for HTTP requests to TMUI endpoints containing unusual path sequences, encoded traversal characters, or unexpected access to internal JSP pages.
• Network Traffic Monitoring: Alert on inbound HTTP/HTTPS requests to the TMUI from unexpected source IPs or geolocations.
• File Integrity Monitoring: Monitor critical system files and TMUI directories for unauthorized modifications.
• Threat Intelligence: Leverage IoCs published by F5, CISA, and security vendors that identify known exploit tools and scanning behaviors associated with CVE-2020-5902.
• Endpoint/Host Detection: Monitor the BIG-IP underlying system for unusual process execution, outbound network connections, or file creation events.

Assessment

CVE-2020-5902 is an exceptionally high-risk vulnerability. The EPSS score of 0.99999 places it in the 100th percentile, indicating near-certain probability of active exploitation. Its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog and the EU Exploited Vulnerabilities Database (EUVD-2020-27056) confirms that it has been weaponized in real-world attacks. The ransomware association (per source metadata) further underscores the severity, as compromised BIG-IP devices can be used to decrypt traffic, move laterally, or disrupt operations.

Key Lessons:

1. Administrative Interfaces Are High-Value Targets: Exposing management UIs like TMUI to broad network ranges, even internally, creates a large attack surface. Strict network segmentation and IP restriction are essential.
2. Path Traversal Can Escalate Quickly: What begins as a simple directory traversal (CWE-22) can escalate to full remote code execution when combined with application-specific functionality. Secure coding practices—especially rigorous path canonicalization and input validation—are critical in web-based management tools.

References

• https://support.f5.com/csp/article/K52145254
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5902
• https://www.kb.cert.org/vuls/id/290915
• https://swarm.ptsecurity.com/rce-in-f5-big-ip/
• https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/
• https://badpackets.net/over-3000-f5-big-ip-endpoints-vulnerable-to-cve-2020-5902/
• https://github.com/Critical-Start/Team-Ares/tree/master/CVE-2020-5902
• http://packetstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/158366/F5-BIG-IP-TMUI-Directory-Traversal-File-Upload-Code-Execution.html