Description
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Netscaler SD-WAN 9.1.2.26.561201 - Command Injection (Metasploit) EDB-42345 · webapps · Jul 19, 2017
- Citrix CloudBridge - 'CAKEPHP' Cookie Command Injection EDB-42346 · webapps · Jul 19, 2017
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 1039019 vdb-entry
- https://support.citrix.com/article/CTX225990
- 42345 exploit
- 99943 vdb-entry
- 42346 exploit