CVE-2025-54755

Executive Summary

CVE-2025-54755 is a directory traversal vulnerability in F5’s TMUI (Traffic Management User Interface). A highly privileged authenticated attacker can exploit this flaw to read arbitrary files outside the intended directory scope, leading to unauthorized disclosure of sensitive configuration data, credentials, or other system files. The vulnerability has a CVSS score of 4.9 (Medium) due to the requirement for high privileges and the lack of impact on integrity or availability. No public exploit code or proof-of-concept is currently available, and the vendor has not issued a patch. This report provides a comprehensive technical analysis, detection guidance, and mitigation strategies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Base Score: 4.9 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is elevated for environments where highly privileged TMUI accounts are exposed to the network. While exploitation requires authentication, the low attack complexity and network accessibility make it a viable target for insider threats or compromised admin accounts.

Deep Dive & Mechanics

The vulnerability resides in the TMUI component of F5 BIG-IP and related products. The TMUI web interface fails to properly sanitize user-supplied path parameters when handling file requests. An authenticated attacker with high privileges (e.g., Administrator role) can craft a request containing directory traversal sequences (e.g., ../) to escape the intended file directory and access arbitrary files on the underlying operating system.

Root Cause: Insufficient input validation in the file retrieval endpoint. The application does not check for path traversal patterns before passing the user input to file system APIs.

Attack Flow:

1. Attacker authenticates to TMUI with a high-privilege account.
2. Attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., /tmui/file/read?path=../../../etc/passwd).
3. The server processes the request and returns the contents of the target file.
4. Attacker exfiltrates sensitive data such as configuration files, SSH keys, or password hashes.

Impact: Unauthorized read access to sensitive files, potentially leading to further compromise of the F5 device or the network.

Vulnerable vs. Patched Code

Since no official patch is available, a comparison cannot be made. However, the vulnerable code likely resembles:

# Vulnerable pseudo-code
def read_file(path):
    # No sanitization
    with open(path, 'r') as f:
        return f.read()

A patched version would include path validation:

# Patched pseudo-code
import os
def read_file(path):
    base_dir = "/var/tmui/files"
    full_path = os.path.normpath(os.path.join(base_dir, path))
    if not full_path.startswith(base_dir):
        raise PermissionError("Access denied")
    with open(full_path, 'r') as f:
        return f.read()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid high-privilege TMUI account (e.g., Administrator).
• Network access to the TMUI web interface (typically port 443 or 8443).

Exploitation Steps:

1. Authenticate to TMUI and obtain a session cookie.
2. Use a tool like curl to send a crafted request:

   curl -k -X GET "https://target/tmui/file/read?path=../../../etc/passwd" \
        -H "Cookie: session=YOUR_SESSION_COOKIE"
   

3. The server will return the contents of /etc/passwd.
4. Iterate through other sensitive files (e.g., /config/bigip.conf, /var/ssh/root/.ssh/id_rsa).

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual file read requests containing ../ or ..\\ patterns in TMUI endpoints.
• Alert on access to sensitive system files (e.g., /etc/shadow, /config/).
• Correlate with authentication logs for high-privilege accounts.

Hunting Queries:

• Search web server logs for GET /tmui/file/read?path= with path traversal sequences.
• Look for repeated attempts to read files outside /var/tmui/.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /tmui/file/read?path= containing ../ or ..\\.
  • Outbound data transfers from the F5 device to external IPs after file access.

• File IOCs:

  • Unexpected access to /etc/passwd, /etc/shadow, /config/bigip.conf, /var/ssh/root/.ssh/id_rsa.
  • Modified timestamps on sensitive files.

• Log IOCs:

  • TMUI audit logs showing file read operations on paths outside /var/tmui/.
  • Authentication logs with high-privilege accounts performing unusual file reads.

Detection Engineering

YARA Rule

rule CVE_2025_54755_TMUI_Traversal {
    meta:
        description = "Detects directory traversal attempts in F5 TMUI logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54755"
    strings:
        $traversal = /\.\.\/|\.\.\\/
        $tmui_path = "/tmui/file/read?path="
    condition:
        $tmui_path and $traversal
}

Sigma Rule

title: F5 TMUI Directory Traversal Attempt
id: 8f9a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects directory traversal attempts in F5 TMUI logs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: f5
detection:
    selection:
        cs-uri-query|contains: "/tmui/file/read?path="
        cs-uri-query|contains: ".."
    condition: selection
falsepositives:
    - Legitimate use of path traversal in non-sensitive contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54755 F5 TMUI Directory Traversal Attempt"; flow:to_server; content:"/tmui/file/read?path="; http_uri; content:"../"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict network access to TMUI to trusted IPs only (e.g., via firewall rules).
2. Enforce multi-factor authentication (MFA) for all TMUI accounts.
3. Monitor and audit all file read operations in TMUI logs.

Long-term Fix:

• Apply vendor patches when released.
• Upgrade to a supported software version if currently on an EoTS release.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Workaround:

• Disable TMUI if not required, or use command-line interface (CLI) for administration.

Valters IT