Web Exploit Attempt: F5 BIG-IP CVE-2020-5902 URI Pattern

title: "Web Exploit Attempt: F5 BIG-IP CVE-2020-5902 URI Pattern"
id: 4e5f2647-08f0-4587-ad5b-39cccc2ef279
status: test
description: This rule flags web requests whose URI query string contains indicators associated with CVE-2020-5902 exploitation against F5 BIG-IP. It matters because successful exploitation can enable unauthorized access or remote code execution attempts. The detection relies on webserver telemetry capturing the request URI query, matching both base-path markers (/tmui/, /hsqldb) and traversal-style sequences (..;/, .jsp/..).
references:
  - https://support.f5.com/csp/article/K52145254
  - https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
  - https://twitter.com/yorickkoster/status/1279709009151434754
  - https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-5902/web_cve_2020_5902_f5_bigip.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-05
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2020-5902
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_base:
    cs-uri-query|contains:
      - /tmui/
      - /hsqldb
  selection_traversal:
    cs-uri-query|contains:
      - ..;/
      - .jsp/..
  condition: selection_base and selection_traversal
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 44b53b1c-e60f-4a7b-948e-3435a7918478
    type: derived