cve: CVE-2019-19781
alias: Citrix NetScaler ADC newbm.pl path traversal + template RCE (Shitrix)
cwe_primary: CWE-22
cwe_acceptable: [CWE-22, CWE-23, CWE-36, CWE-73, CWE-74, CWE-94]
target_file: source.pl
vuln_lines: [21, 22, 24, 26, 27]
severity: critical
vuln_class: path_traversal
exploit_pattern_regex: '(\.\./|%2e%2e|\.\.%2f)'
must_mention_any:
  - traversal
  - path traversal
  - normalisation
  - normalization
  - ../
  - unsanitised
  - unsanitized
  - arbitrary write
  - directory
points: 30
notes: |
  Vulnerability: $url is interpolated directly into a filesystem path with no
  normalisation, allowing ../ to escape /var/vpn/bookmark/ and write arbitrary
  files. Combined with the templating engine, the attacker plants a template
  containing `qx{}` and triggers RCE.
  Hunter MUST identify:
    1. $url is attacker-controlled (CGI param).
    2. Direct concatenation into filesystem path with no path normalisation.
    3. Arbitrary file write → leads to RCE via subsequent template execution.