29 lines
1.1 KiB
Perl
29 lines
1.1 KiB
Perl
#!/usr/bin/perl
|
|
# Citrix NetScaler ADC `/vpn/portal/scripts/newbm.pl` — pre-CVE-2019-19781.
|
|
# Authenticated bookmark creation endpoint that writes a user-supplied XML
|
|
# template to a directory derived from the URL. Path traversal in the
|
|
# `url` parameter lets an unauth attacker write to /netscaler/portal/templates/
|
|
# then trigger execution via /vpns/cfg/smb.conf with the template name.
|
|
|
|
use strict;
|
|
use warnings;
|
|
use CGI qw(:standard);
|
|
|
|
my $q = CGI->new();
|
|
my $url = $q->param('url'); # attacker-controlled
|
|
my $title = $q->param('title'); # attacker-controlled XML body
|
|
|
|
# BUG: $url is concatenated into the destination path without normalisation.
|
|
# Attacker submits url=../../netscaler/portal/templates/EVIL.xml plus a
|
|
# crafted XML body that includes a perl `print qx{...}` template tag.
|
|
# When subsequently rendered, the qx{} executes arbitrary shell.
|
|
my $base = '/var/vpn/bookmark/';
|
|
my $path = $base . $url . '.xml';
|
|
|
|
open(my $fh, '>', $path) or die "cannot open $path: $!";
|
|
print $fh "<bookmark><title>$title</title></bookmark>";
|
|
close($fh);
|
|
|
|
print "Content-Type: text/plain\n\n";
|
|
print "ok\n";
|