cancel
Showing results for 
Search instead for 
Did you mean: 
Harsh_Chawla
F5 Employee
F5 Employee

Overview

On December 17th, Citrix published an article reporting a vulnerability in Citrix Application Delivery Controller and Citrix Gateway leading to arbitrary code execution. The following product versions were affected:

·      Citrix ADC and Citrix Gateway version 13.0 all supported builds

·      Citrix ADC and NetScaler Gateway version 12.1 all supported builds

·      Citrix ADC and NetScaler Gateway version 12.0 all supported builds

·      Citrix ADC and NetScaler Gateway version 11.1 all supported builds

·      Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds


Citrix credited Mikhail Klyuchnikov of Positive Technologies, and Gianlorenzo Cipparrone and Miguel Gonzalez of Paddy Power Betfair plc but did not release any details regarding the vulnerability. Citrix provided an expected release date for patched versions with the earliest patched version expected to ship on 20th January, 2020. Citrix also provided steps to mitigate the vulnerability. The following mitigation steps were provided for a standalone system.


enable ns feature responder

add responder action respondwith403 respondwith "\"HTTP/1.1 403 Forbidden\r\n\r\n\""

add responder policy ctx267027 "HTTP.REQ.URL.DECODE_USING_TEXT_MODE.CONTAINS(\"/vpns/\") && (!CLIENT.SSLVPN.IS_SSLVPN || HTTP.REQ.URL.DECODE_USING_TEXT_MODE.CONTAINS(\"/../\"))" respondwith403

bind responder global ctx267027 1 END -type REQ_OVERRIDE

save config 


Vulnerability Analysis and Exploit POC

On 11th January, 2020, a group of security researchers from India, Project Zero India released a working POC exploiting the vulnerability. This release was shortly followed by other security researchers releasing their exploit POC and vulnerability scanners.


By analyzing the mitigation steps provided by Citrix, Security Researchers were able to figure out where the vulnerability lies and how to exploit it. The vulnerability can be exploited by an HTTP request that includes either ‘/vpns/’ or ‘/../’ in the URL. This directory traversal vulnerability is further affected by construction of an XML file by using unsanitized HTTP request headers. The application uses NSC_USER HTTP header to create an XML file. This allows an attacker to control the filename and the contents of the XML file.

Once an attacker is able to create an XML file on the vulnerable server, an attacker can use Perl Template Toolkit to parse the XML file to execute commands.


There are various exploits available online and a malicious first request would look like this:

0151T000003lUJRQA2.png

Figure 1 : Initial request sent by an attacker. The RandomFileName in the NSC_USER header value is used to create an XML file.


A vulnerable server will create an XML file named RandomFileName (used in the NSC_USER header) in the /vpns/portal folder. Another GET request to this file location will result in command execution.

0151T000003lUJbQAM.png

Figure 2 : If the attacker is able to successfully create the XML file, the command output will be visible by accessing this page.


Mitigation through Big-IP ASM


ASM customers under any supported BIG-IP version are already protected against this vulnerability. The exploitation attempt will be detected by existing signatures to detect “Directory Traversal and “Command Execution”.

0151T000003lUJgQAM.png

Figure 3 : Exploitation attempt detected with existing Directory Traversal attempt signatures for header and POST content.



0151T000003lUJSQA2.png

Figure 4 : Exploitation attempt detected with existing Command execution attempt signatures (uname for this example).


Furthermore, Big-IP ASM now has a dedicated signature to capture exploitation attempts against this vulnerability.

0151T000003lVCqQAM.jpg

Figure 5 : Dedicated signature to detect exploit attempt.

Comments
Nadams
Nimbostratus
Nimbostratus

Can we get an update mentioning the Attack Signature ID # for the dedicated signature?

Harsh_Chawla
F5 Employee
F5 Employee

The new Attack Signature ID is 200004998.

Version history
Last update:
‎15-Jan-2020 09:33
Updated by:
Contributors