F5 BIG-IP TMUI Flaw: Emergency WAF Rule Released
Cloudflare has rolled out an emergency managed rule targeting CVE-2020-5902, a remote code execution vulnerability in F5 BIG-IP’s web-based Traffic Management User Interface (TMUI). The new rule, 100315, is enabled by default with a BLOCK action for all Cloudflare WAF customers.
F5’s advisory includes patching guidance, detection methods for exploit attempts, and custom mitigation steps. Any organization running an affected F5 device should review those instructions without delay.
According to F5’s disclosure, the flaw permits both authenticated and unauthenticated users to execute arbitrary code on the target system. In practice, that often translates into full administrative compromise and system takeover. Importantly, the bug is confined to the management dashboard; traffic passing through the data plane is not affected.
Attack Activity and Exploit Patterns
Observed exploit attempts have accelerated sharply since the vulnerability was made public. Cloudflare’s telemetry shows probe volume climbing from roughly 1,000 requests on July 3 to about one million by the following day — a pattern consistent with the rapid inclusion of simple test strings into widely used scanning tools.
The most commonly observed probing URLs include:
/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp/tmui/login.jsp/..;/tmui/util/getTabSet.jsp/tmui/login.jsp/..;/tmui/system/user/authproperties.jsp/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp
Each of these contains the path traversal sequence ..;, which lies at the core of the flaw.
Blocking the Attack
For environments where patching is not immediately possible, administrators can filter requests whose URL matches the regular expression .*\.\.;.*. This pattern flags any string containing two dots followed by a semicolon.
Cloudflare WAF customers who proxy their F5 TMUI interface through Cloudflare are already shielded by rule 100315 with a default action of BLOCK. To adjust the rule’s behavior:
- Navigate to the Cloudflare Firewall section and open Managed Rules; click the "advanced" link within the Cloudflare Managed Rule set.
- Search for rule ID
100315. - Select the desired action or disable the rule entirely if necessary.
