Web Exploitation Attempt Pattern for CVE-2020-5902 on F5 BIG-IP (URI Traversal)
Alerts on web requests with query patterns consistent with CVE-2020-5902 exploitation attempts targeting F5 BIG-IP.
- Category
- webserver
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-07-05
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies HTTP requests targeting F5 BIG-IP endpoints that include both specific URI components associated with the vulnerable surface and traversal-like sequences in the query string. Attackers often use crafted paths to reach unintended application behavior or backends during exploitation attempts. Telemetry required is webserver HTTP request data, specifically the request URI query string contents.
Reporting behind it
- support.f5.comhttps://support.f5.com/csp/article/K52145254
- ptsecurity.comhttps://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
- twitter.comhttps://twitter.com/yorickkoster/status/1279709009151434754
- criticalstart.comhttps://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-5902/web_cve_2020_5902_f5_bigip.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Web Exploitation Attempt Pattern for CVE-2020-5902 on F5 BIG-IP (URI Traversal)
id: 4e5f2647-08f0-4587-ad5b-39cccc2ef279
status: test
description: This rule identifies HTTP requests targeting F5 BIG-IP endpoints that include both specific URI components associated with the vulnerable surface and traversal-like sequences in the query string. Attackers often use crafted paths to reach unintended application behavior or backends during exploitation attempts. Telemetry required is webserver HTTP request data, specifically the request URI query string contents.
references:
- https://support.f5.com/csp/article/K52145254
- https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
- https://twitter.com/yorickkoster/status/1279709009151434754
- https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-5902/web_cve_2020_5902_f5_bigip.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-05
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2020-5902
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_base:
cs-uri-query|contains:
- /tmui/
- /hsqldb
selection_traversal:
cs-uri-query|contains:
- ..;/
- .jsp/..
condition: selection_base and selection_traversal
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 44b53b1c-e60f-4a7b-948e-3435a7918478
type: derived