what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Sandeep Singh

F5 BIG-IP TMUI AJP Smuggling Remote Command Execution

Posted Nov 14, 2023

Authored by Spencer McIntyre, Sandeep Singh, Thomas Hendrickson, Michael Weber | Site metasploit.com

This Metasploit module exploits a flaw in F5's BIG-IP Traffic Management User Interface (TMU) that enables an external, unauthenticated attacker to create an administrative user. Once the user is created, the module uses the new account to execute a command payload. Both the exploit and check methods automatically delete any temporary accounts that are created.

tags | exploit

advisories | CVE-2023-46747

SHA-256 | bcbdbabc4837b17bad9381305927746284c61e88f6b8675d316eecb578535b4d

Download | Favorite | View