HP ThinPro 6.x / 7.x Citrix Command Injection

`HP ThinPro - Citrix command injection  
===============================================================================  
  
Identifiers  
-------------------------------------------------  
* CVE-2019-18909  
  
CVSSv3 score  
-------------------------------------------------  
6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)  
  
Vendor  
-------------------------------------------------  
HP - [https://www.hp.com](https://www.hp.com)  
  
Product  
-------------------------------------------------  
Deliver secure desktop virtualization that’s as comfortable for IT as it is  
for end users with the stunningly redesigned HP ThinPro. It has a bold new  
user interface and workflow refinements that make it a breeze to configure,  
manage, and use right out of the box.  
  
Affected versions  
-------------------------------------------------  
- HP ThinPro Linux 7.1  
- HP ThinPro Linux 7.0  
- HP ThinPro Linux 6.2.1  
- HP ThinPro Linux 6.2  
  
Credit  
-------------------------------------------------  
Eldar Marcussen - xen1thLabs - Software Labs  
  
Vulnerability summary  
-------------------------------------------------  
The Citrix receiver conection wrapper function does not safely handle user  
supplied data allowing an unauthenticated attacker to use commandline  
syntax to execute arbitrary commands on the device.  
  
Technical details  
------------------------------------------------  
The user supplied values provided for the domain portion of the login  
screens for `Citrix receiver` is vulnerable to command injection, an  
unauthenticated attacker can exploit this to execute commands with the  
privileges of the local user.  
  
Proof of concept  
-------------------------------------------------  
The following evidence is provided to illustrate the existence and  
exploitation:  
  
1. At the `Citrix receiver` login screen enter the following details:  
* username: \pwnt  
* password: pwnt  
* Domain should be empty  
2. Click `Connect`  
3. In the `Citrix server details` window, enter the following for domain:  
`;xterm;echo `  
4. Click `Connect`  
5. Observe that xterm spawns  
  
Solution  
-------------------------------------------------  
Contact vendor for a solution  
  
Timeline  
-------------------------------------------------  
Date | Status  
------------|-----------------------------  
19-AUG-2019 | Reported to vendor  
22-NOV-2019 | Patch available  
24-MAR-2020 | Public disclosure  
  
  
`