The vulnerability of the microprogramming software used in access control systems for the NetScaler Gateway virtual environment and the Citrix NetScaler Application Delivery Controller lies in the improper name restrictions on the path to the restricted directory. This allows attackers to gain access to published applications and carry out attacks from the Citrix server to other resources within the attacked company’s internal network.

🗓️ 15 May 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Improper restricted-path limits in NetScaler Gateway and NetScaler ADC enable remote access to published apps.

Reporter	Title	Published	Views	Family All 173
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	9 Jul 202005:17	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	9 Jul 202014:26	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	21 Jan 202023:13	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	13 Jan 202007:42	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	28 Jan 202012:09	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	11 Jan 202000:08	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	10 Jan 202022:56	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	23 Jan 202008:41	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	17 Jul 202011:52	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	30 Jul 202017:37	–	githubexploit

Vulners

Node

citrix_systems netscaler_application_delivery_controllerMatch10.5

OR

citrix_systems netscaler_application_delivery_controllerMatch11.1

OR

citrix_systems netscaler_application_delivery_controllerMatch12.0

OR

citrix_systems netscaler_gatewayMatch10.5

OR

citrix_systems netscaler_gatewayMatch11.1

OR

citrix_systems netscaler_gatewayMatch12.0

OR

citrix_systems netscaler_application_delivery_controllerMatch12.1

OR

citrix_systems netscaler_application_delivery_controllerMatch13.0

OR

citrix_systems netscaler_gatewayMatch12.1

OR

citrix_systems netscaler_gatewayMatch13.0

Source	Link
safe	www.safe.cnews.ru/news/line/2019-12-19_positive_technologies_obnaruzhila_uyazvimost
support	www.support.citrix.com/article/CTX267027
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-19781
web	www.web.nvd.nist.gov/view/vuln/detail

15 May 2020 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 39.8

CVSS 210

EPSS0.99999

NetScaler Gateway NetScaler Application Delivery Restricted Path Limits Remote Access Published Applications Internal Network