#!/usr/bin/perl
# Citrix NetScaler ADC `/vpn/portal/scripts/newbm.pl` — pre-CVE-2019-19781.
# Authenticated bookmark creation endpoint that writes a user-supplied XML
# template to a directory derived from the URL.  Path traversal in the
# `url` parameter lets an unauth attacker write to /netscaler/portal/templates/
# then trigger execution via /vpns/cfg/smb.conf with the template name.

use strict;
use warnings;
use CGI qw(:standard);

my $q   = CGI->new();
my $url = $q->param('url');     # attacker-controlled
my $title = $q->param('title'); # attacker-controlled XML body

# BUG: $url is concatenated into the destination path without normalisation.
# Attacker submits url=../../netscaler/portal/templates/EVIL.xml plus a
# crafted XML body that includes a perl `print qx{...}` template tag.
# When subsequently rendered, the qx{} executes arbitrary shell.
my $base = '/var/vpn/bookmark/';
my $path = $base . $url . '.xml';

open(my $fh, '>', $path) or die "cannot open $path: $!";
print $fh "<bookmark><title>$title</title></bookmark>";
close($fh);

print "Content-Type: text/plain\n\n";
print "ok\n";