name: Detect F5 TMUI RCE CVE-2020-5902
id: 810e4dbc-d46e-11ea-87d0-0242ac130003
version: 1
date: '2020-08-02'
author: Shannon Davis, Splunk
type: batch
datamodel: []
description: This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ,
  and Traffix SDC devices
search: '`f5_bigip_rogue` | regex _raw="(hsqldb;|.*\\.\\.;.*)" | search `detect_f5_tmui_rce_cve_2020_5902_filter`'
how_to_implement: To consistently detect exploit attempts on F5 devices using the
  vulnerabilities contained within CVE-2020-5902 it is recommended to ingest logs
  via syslog.  As many BIG-IP devices will have SSL enabled on their management interfaces,
  detections via wire data may not pick anything up unless you are decrypting SSL
  traffic in order to inspect it.  I am using a regex string from a Cloudflare mitigation
  technique to try and always catch the offending string (..;), along with the other
  exploit of using (hsqldb;).
known_false_positives: unknown
references:
- https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
- https://support.f5.com/csp/article/K52145254
- https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/
tags:
  analytic_story:
  - F5 TMUI RCE CVE-2020-5902
  asset_type: Network
  cis20:
  - CIS 8
  - CIS 11
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1190
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  security_domain: network
