Citrix Command Center Configuration Disclosure

`------------------------------------------------------------------------  
Citrix Command Center allows downloading of configuration files  
------------------------------------------------------------------------  
Han Sahin, August 2014  
  
------------------------------------------------------------------------  
Abstract  
------------------------------------------------------------------------  
It was discovered that Citrix Command Center stores configuration files  
containing credentials of managed devices within a folder accessible  
through the web server. Unauthenticated attackers can download any  
configuration file stored in this folder, decode passwords stored in  
these files, and gain privileged access to devices managed by Command  
Center.  
  
------------------------------------------------------------------------  
Tested version  
------------------------------------------------------------------------  
This issue was discovered in Citrix Command Center 5.1 build 33.3  
(including patch CC_SP_5.2_40_1.exe), other versions may also be  
vulnerable.  
  
------------------------------------------------------------------------  
Fix  
------------------------------------------------------------------------  
Citrix reports that this vulnerability is fixed in Command Center 5.2  
build 42.7, which can be downloaded from the following location (login  
required).  
https://www.citrix.com/downloads/command-center/product-software/command-center-52-427.html  
  
Citrix assigned BUG0493933 to this issue.  
  
------------------------------------------------------------------------  
Details  
------------------------------------------------------------------------  
https://www.securify.nl/advisory/SFY20140802/citrix_command_center_allows_downloading_of_configuration_files.html  
  
Configuration files can be downloaded from the conf web folder. Below is an example of a configuration file that can be obtained this way.  
  
https://<target>:8443/conf/securitydbData.xml  
  
This files contains encoded passwords, for example:  
  
<DATA ownername="NULL" password="C70A0eE9os9T2z" username="root"/>  
  
These passwords can be decoded trivially. The algorithm used can be found in the JAR file NmsServerClasses.jar. For example the encoded password C70A0eE9os9T2z decodes to SECURIFY123. The credentials stored in these files can than be used to gain privileged access to devices managed by Command Center.  
`