Contents

  1. General Disclosure
  2. POC
  3. Affected Systems
  4. Possible Mitigations
  5. Infections
  6. References

General Disclosure

A directory traversal bug within Citrix ADC (NetScalers) which calls a perl script that is used to append files in an XML format to the victim machine. This in turn allows for remote code execution. It't going public on 17 December 2019.

POC

If you want to test to see if this exposure is mitigated use the following: 

curl https://host/vpn/../vpns/cfg/smb.conf --path-as-is

Either a 403 means that you are patched or if it returns a Citrix website and NOT the smb.conf file itself. If you can see smb.conf, then you are vulnerable.

There is also a POC available on github: https://github.com/trustedsec/cve-2019-19781

Affected Systems

Here is a list of the operating systems we have tested which are vulnerable to this attack:

Possible Mitigations

Citrix has published a possible mitigation on there website. https://support.citrix.com/article/CTX267679

Infections

References

CVE/2019/19781 (last edited 2020-01-27 14:51:46 by Sciuro)