Citrix ADC Path Traversal RCE (Shitrix)
- Product
- Citrix ADC / Gateway / SD-WAN WANOP
- CVE
- CVE-2019-19781
- Disclosed
- 2019-12-17
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Citrix ADC and Gateway 10.5, 11.1, 12.0, 12.1 and 13.0; SD-WAN WANOP 10.2.x/11.x.
- Fixed
- 10.5.70.12, 11.1.63.15, 12.0.63.13, 12.1.55.18, 13.0.47.24 (released January 2020).
Summary
A directory traversal in the Citrix ADC/Gateway VPN portal let unauthenticated attackers write and then render a template file, executing commands on the appliance. Public exploits appeared in January 2020 before patches shipped, leading to mass exploitation by ransomware operators and state actors.
Root cause
Requests that traversed out of the /vpn/ path reached Perl CGI scripts under /vpns/ without authentication. One of those scripts writes a bookmark XML file to a path derived from a request header, allowing a file to be planted in the portal template directory. Content in that file is later processed by the Perl Template Toolkit, which evaluates embedded directives and leads to command execution as the nobody user.
Impact
Unauthenticated remote code execution on the gateway, typically followed by credential theft, webshells and lateral movement.
Detection
Review HTTP logs for requests to /vpns/portal/scripts/*.pl containing '/../' and look for unexpected XML files under /netscaler/portal/templates/ or /var/tmp/netscaler/portal/templates/. Nuclei template CVE-2019-19781; Citrix and FireEye published an IOC scanner.
Mitigation
Upgrade to a fixed build and perform compromise assessment; Citrix's interim responder policy blocking traversal into /vpns/ was the stop-gap.