cbcvebase.
CVE-2020-8193
published 2020-07-10

CVE-2020-8193: Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP…

PriorityP185medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
88.41%
99.8th percentile
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.

Affected

21 ranges
VendorProductVersion rangeFixed in
citrixapplication_delivery_controller_firmware>= 10.5 < 10.5-70.1810.5-70.18
citrixapplication_delivery_controller_firmware>= 11.1 < 11.1-64.1411.1-64.14
citrixapplication_delivery_controller_firmware>= 12.0 < 12.0-63.2112.0-63.21
citrixapplication_delivery_controller_firmware>= 12.1 < 12.1-57.1812.1-57.18
citrixapplication_delivery_controller_firmware>= 13.0 < 13.0-58.3013.0-58.30
citrixcitrix_adc
citrixcitrix_application_delivery_controller
citrixcitrix_gateway
citrixcitrix_sd-wan_wanop
citrixgateway_firmware>= 13.0 < 13.0-58.3013.0-58.30
citrixnetscaler_adc
citrixnetscaler_gateway
citrixnetscaler_gateway_firmware>= 10.5 < 10.5-70.1810.5-70.18
citrixnetscaler_gateway_firmware>= 11.1 < 11.1-64.1411.1-64.14
citrixnetscaler_gateway_firmware>= 12.0 < 12.0-63.2112.0-63.21
citrixnetscaler_gateway_firmware>= 12.1 < 12.1-57.1812.1-57.18
citrixsd-wan
citrixsd-wan_wanop>= 10.2 < 10.2.710.2.7
citrixsd-wan_wanop>= 11.0 < 11.0.3d11.0.3d
citrixsd-wan_wanop>= 11.1 < 11.1.1a11.1.1a
citrixxenserver

Detection & IOCsextracted from sources · hover to see the quote

url/pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1
url/menu/ss?sid=nsroot&username=nsroot&force_setup=1
url/menu/neo
url/menu/stc
url/rapi/filedownload?filter=path:%2Fetc%2Fpasswd
path/nsconfig/ns.conf
path/var/nstmp
path/etc/passwd
yara
regex: root:.*:0:0:
  • Detect exploit attempts by monitoring for POST requests to /pcidss/report with the query parameters type=allprofiles, sid=loginchallengeresponse1requestbody, and username=nsroot from unauthenticated sources.
  • Detect LFI exploitation stage by monitoring for POST requests to /rapi/filedownload with a filter=path: parameter, especially targeting /etc/passwd or /nsconfig/ns.conf.
  • Monitor HTTP requests containing both X-NITRO-USER and X-NITRO-PASS headers sent to the /pcidss/report or /rapi/filedownload endpoints, which are characteristic of this exploit chain.
  • Monitor for scanning and exploit activity against external-facing services using DigitalOcean and Vultr Holdings/Choopa infrastructure, as VANADINITE leverages these ASNs for exploitation.
  • The exploit requires access to the NetScaler IP (NSIP)/management interface; restrict NSIP access to trusted management networks to reduce attack surface.
  • ·The exploit chain requires the attacker to have network access to the NetScaler IP (NSIP) management interface; exploitation is not possible from the internet if NSIP is properly restricted.
  • ·The Metasploit module targets port 443 with SSL by default; detections should also cover non-standard HTTPS management ports if NSIP is exposed on alternate ports.

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vulncheck6.5MEDIUM
cisa6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.