30 lines
1014 B
YAML
30 lines
1014 B
YAML
cve: CVE-2019-19781
|
|
alias: Citrix NetScaler ADC newbm.pl path traversal + template RCE (Shitrix)
|
|
cwe_primary: CWE-22
|
|
cwe_acceptable: [CWE-22, CWE-23, CWE-36, CWE-73, CWE-74, CWE-94]
|
|
target_file: source.pl
|
|
vuln_lines: [21, 22, 24, 26, 27]
|
|
severity: critical
|
|
vuln_class: path_traversal
|
|
exploit_pattern_regex: '(\.\./|%2e%2e|\.\.%2f)'
|
|
must_mention_any:
|
|
- traversal
|
|
- path traversal
|
|
- normalisation
|
|
- normalization
|
|
- ../
|
|
- unsanitised
|
|
- unsanitized
|
|
- arbitrary write
|
|
- directory
|
|
points: 30
|
|
notes: |
|
|
Vulnerability: $url is interpolated directly into a filesystem path with no
|
|
normalisation, allowing ../ to escape /var/vpn/bookmark/ and write arbitrary
|
|
files. Combined with the templating engine, the attacker plants a template
|
|
containing `qx{}` and triggers RCE.
|
|
Hunter MUST identify:
|
|
1. $url is attacker-controlled (CGI param).
|
|
2. Direct concatenation into filesystem path with no path normalisation.
|
|
3. Arbitrary file write → leads to RCE via subsequent template execution.
|