CVE-2020-8196

published 2020-07-10

CVE-2020-8196: Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP…

Priority P1 80 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

KEV ITW EXPLOIT Ransomware

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

Affected

21 ranges

Vendor	Product	Version range	Fixed in
citrix	application_delivery_controller_firmware	>= 10.5 < 10.5-70.18	10.5-70.18
citrix	application_delivery_controller_firmware	>= 11.1 < 11.1-64.14	11.1-64.14
citrix	application_delivery_controller_firmware	>= 12.0 < 12.0-63.21	12.0-63.21
citrix	application_delivery_controller_firmware	>= 12.1 < 12.1-57.18	12.1-57.18
citrix	application_delivery_controller_firmware	>= 13.0 < 13.0-58.30	13.0-58.30
citrix	citrix_adc	—	—
citrix	citrix_application_delivery_controller	—	—
citrix	citrix_gateway	—	—
citrix	citrix_sd-wan_wanop	—	—
citrix	gateway_firmware	>= 13.0 < 13.0-58.30	13.0-58.30
citrix	netscaler_adc	—	—
citrix	netscaler_gateway	—	—
citrix	netscaler_gateway_firmware	>= 10.5 < 10.5-70.18	10.5-70.18
citrix	netscaler_gateway_firmware	>= 11.1 < 11.1-64.14	11.1-64.14
citrix	netscaler_gateway_firmware	>= 12.0 < 12.0-63.21	12.0-63.21
citrix	netscaler_gateway_firmware	>= 12.1 < 12.1-57.18	12.1-57.18
citrix	sd-wan	—	—
citrix	sd-wan_wanop	>= 10.2 < 10.2.7	10.2.7
citrix	sd-wan_wanop	>= 11.0 < 11.0.3d	11.0.3d
citrix	sd-wan_wanop	>= 11.1 < 11.1.1a	11.1.1a
citrix	xenserver	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1↗

url /menu/ss?sid=nsroot&username=nsroot&force_setup=1↗

url /rapi/filedownload?filter=path:<path>↗

path /nsconfig/ns.conf↗

path /etc/passwd↗

path /var/nstmp↗

cookie SESSID↗

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Citrix Authentication Bypass Attempt Inbound (CVE-2020-8193)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"&sid=loginchallenge"; content:"&username=nsroot"; distance:0; fast_pattern; http.request_body; content:"<appfwprofile"; startswith; reference:url,research.nccgroup.com/2020/07/10/rift-citrix-adc-vulnerabilities-cve-2020-8193-cve-2020-8195-and-cve-2020-8196-intelligence/; reference:cve,2020-8193; classtype:attempted-admin; sid:2031067; rev:2; metadata:created_at 2020_10_21, cve CVE_2020_8193, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Citrix Information Disclosure Attempt Inbound (CVE-2020-8195)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"?filter=path|3a 25|2F"; fast_pattern; http.request_body; content:"<clipermission"; startswith; reference:url,research.nccgroup.com/2020/07/10/rift-citrix-adc-vulnerabilities-cve-2020-8193-cve-2020-8195-and-cve-2020-8196-intelligence/; reference:cve,2020-8195; classtype:attempted-admin; sid:2031068; rev:1; metadata:created_at 2020_10_21, cve CVE_2020_8195, deployment Perimeter, deployment Internal, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_21, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1082, mitre_technique_name System_Information_Discovery;)

• → Session creation request uses POST to /pcidss/report with query params including 'sid=loginchallengeresponse1requestbody' and 'username=nsroot', with arbitrary X-NITRO-USER and X-NITRO-PASS headers and an XML content-type body. Server responds with HTTP 406 on success. ↗
• → LFI file read requests are sent via POST to /rapi/filedownload with a 'filter=path:<URL-encoded path>' query parameter, a rand_key header, and an XML content-type. Server responds with HTTP 406 on successful file read. ↗
• → Exploit chain requires a valid SESSID cookie obtained from the /pcidss/report bypass endpoint, then a rand value extracted from /menu/ss, before issuing the LFI read against /rapi/filedownload. ↗
• → Successful exploitation of the auth bypass (CVE-2020-8193) is confirmed when the /etc/passwd read via /rapi/filedownload returns a body containing 'root:*:0:0:'. ↗
• → The ET Snort rule (sid:2031067) detects the auth bypass stage by matching POST requests with URI containing '&sid=loginchallenge' and '&username=nsroot', and request body starting with '<appfwprofile'.
• → The ET Snort rule (sid:2031068) detects the LFI/information disclosure stage by matching POST requests with URI containing '?filter=path|3a 25|2F' (URL-encoded path traversal) and request body starting with '<clipermission'.

• · CVE-2020-8196 (information disclosure) is chained with CVE-2020-8193 (authentication bypass) in exploitation. The sources note it is unclear at exploit time whether the LFI stage triggers CVE-2020-8195 or CVE-2020-8196 specifically. ↗
• · The exploit targets the NSIP/management interface. Restricting network access to this interface reduces exposure. ↗

CVSS provenance

nvd v3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

vulncheck 4.3 MEDIUM

cisa 4.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284 CWE-287 CWE-862