Citrix and NetScaler SD-WAN Center Unauthenticated Directory Traversal File Write

The remote Citrix SD-WAN Center or NetScaler SD-WAN Center is susceptible to directory traversal and file writes in arbitrary locations. This is due to improper sanitization of user-supplied input in the applianceSettingsFileTransfer action of ApplianceSettingsController. An unauthenticated, remo...

Citrix Application Delivery Controller and Citrix Systems Gateway Path Traversal Vulnerability

Citrix Systems NetScaler Gateway Citrix Systems Gateway and Citrix Application Delivery Controller ADC are products of Citrix Systems, Inc.Citrix Systems NetScaler Gateway is a secure remote access solution. The solution provides administrators with application-level and data-level controls to...

Citrix SD-WAN Center trace_route Unauthenticated Remote Command Injection

The remote Citrix SD-WAN Center is affected by a remote command injection vulnerability due to improper sanitization of user-supplied input in the traceroute action of DiagnosticController. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to execute...

CVE-2019-19781 - Vulnerability in Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP appliance

Description of Problem A vulnerability has been identified in Citrix Application Delivery Controller ADC formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution. The scop...

PT-2019-5255

Name of the Vulnerable Software and Affected Versions Citrix Application Delivery Controller ADC and Gateway versions 10.5 through 13.0 Description The issue exists due to incorrect restriction of the directory path name with limited access. Exploitation of this issue may allow a remote attacker ...

Citrix ADC (NetScaler) Directory Traversal RCE

This module exploits a directory traversal in Citrix Application Delivery Controller ADC, aka NetScaler, and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0, to execute an arbitrary command payload. Module Options msf use exploit/freebsd/http/citrix/dirtraversalrce msf undefineddirtraversalrce show...

Citrix ADC (NetScaler) Directory Traversal Scanner

This module exploits a directory traversal vulnerability CVE-2019-19781 within Citrix ADC NetScaler. It requests the smb.conf file located in the /vpns/cfg directory by issuing the request /vpn/../vpns/cfg/smb.conf. It then checks if the server is vulnerable by looking for the presence of a...

Multiple Citrix Products CVE-2019-19781 Remote Code Execution Vulnerability

Description Multiple Citrix Products are prone to a remote code-execution vulnerability. Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the application. Technologies Affected Citrix NetScaler Gateway 10.5 Citrix NetScaler Gateway 11.1 Citri...

Session Launch Failure: “Your session 'AppName' did not launch successfully due to error code 3500

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. When launching an application or desktop session using Citrix Workspace App, the session fails to...

Failed to launch session with the error code “Your session 'AppName' did not launch successfully due to error code 3505. Please contact your administrator for more information about the error.” on Citrix Workspace App During App/Desktop Launch

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. When launching an application or desktop session using Citrix Workspace App, the session fails to...

Failed to launch session with the error code “<AppName> is no longer available. Do you want to remove the shortcut?” on Citrix Workspace App during App/Desktop Launch

When a user tries to launch published application or Desktop by double clicking the shortcut of published applications or Desktops created on user’s Desktop or Start menu, launch fails with error “'AppName' is no longer available. Do you want to remove the shortcut?” Note: This error only applies...

VulnCheck KEV: CVE-2017-6316

A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability...

Template::Toolkit -- Directory traversal on write

Art Manion and Will Dormann report: By using an older and less-secure form of open, it is possible for untrusted template files to cause reads/writes outside of the template directories. This vulnerability is a component of the recent Citrix exploit...

Citrix Hypervisor Security Update

Description of Problem A number of vulnerabilities have been found in Citrix Hypervisor formerly Citrix XenServer that may: i. Allow the host to be compromised by privileged code in a PV guest VM, ii. allow unprivileged code in a HVM guest VM to cause that guest to crash and iii. under certain...

Xen CVE-2019-19583 Denial of Service Vulnerability

Description Xen is prone to a denial-of-service vulnerability. Attackers can exploit this issue to crash the affected application, denying service to legitimate users. Xen Xen version through 4.12.0 are vulnerable. Technologies Affected Citrix Hypervisor 8.0 Citrix XenServer 7.0 Citrix XenServer...

Xen CVE-2019-19580 Incomplete Fix Local Privilege Escalation Vulnerability

Description Xen is prone to a local privilege-escalation vulnerability. Local attacker can exploit this issue to gain elevated privileges on affected computers. Xen version 4.12.x and prior are vulnerable. Technologies Affected Citrix Hypervisor 8.0 Citrix XenServer 7.0 Citrix XenServer 7.1 LTSR...

Xen CVE-2019-19577 Denial of Service Vulnerability

Description Xen is prone to a denial-of-service vulnerability. Attackers can exploit this issue to crash the affected application, denying service to legitimate users. Xen Xen version through 4.12.0 are vulnerable. Technologies Affected Citrix Hypervisor 8.0 Citrix XenServer 7.0 Citrix XenServer...

How to install Citrix Workspace app on Android phones and tablets

This article is intended for Citrix administrators and technical teams only. This article describes how to install Citrix Workspace app formerly Citrix Receiver on Android phones and tablets. Background : With Citrix Workspace app for the Android phones and tablets, you can access any Citrix...

How to Remove Client Files Remaining on System after Uninstalling Receiver for Windows

This article is intended for Citrix administrators and technical teams only. NOTE: Receiver for Windows version 4.4 or later does not require these manual steps. Receiver for Windows 4.4 and later no longer requires separate Clean-Up Utility before installing or upgrading over a previously...

PT-2020-01: Arbitrary code execution in Citrix ADC

This vulnerability allows an unauthorized, remote attacker to execute malicious code on the system, obtain unauthorized access to published applications, and attack intranet resources of the target organization via Citrix servers. Advisory status: 05.12.2019 - Vendor gets vulnerability details...