Description
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
Citrix ADC (NetScaler) Directory Traversal Scanner
auxiliary/scanner/http/citrix_dir_traversal
-
Citrix ADC (NetScaler) Directory Traversal RCE
exploit/freebsd/http/citrix_dir_traversal_rce
Exploit-DB 3
- Citrix Application Delivery Controller (ADC) and Gateway 13.0 - Path Traversal EDB-47930 · webapps · Jan 16, 2020
- Citrix Application Delivery Controller and Gateway 10.5 - Remote Code Execution (Metasploit) EDB-47913 · webapps · Jan 13, 2020
- Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution (PoC) EDB-47901 · webapps · Jan 11, 2020
GitHub 44 repositories · most starred shown
-
trustedsec/cve-2019-19781 ★ 574 · Jan 11, 2020
This is a tool published for the Citrix ADC (NetScaler) vulnerability. We are only disclosing this due to others publishing the exploit code first.
-
projectzeroindia/CVE-2019-19781 ★ 368 · Jan 10, 2020
Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway [ CVE-2019-19781 ]
-
mpgn/CVE-2019-19781 ★ 157 · Jan 11, 2020
CVE-2019-19781 - Remote Code Execution on Citrix ADC Netscaler exploit
-
MalwareTech/CitrixHoneypot ★ 120 · Jan 13, 2020
Detect and log CVE-2019-19781 scan and exploitation attempts.
-
cisagov/check-cve-2019-19781 ★ 110 · Jan 11, 2020
Test a host for susceptibility to CVE-2019-19781
-
mandiant/ioc-scanner-CVE-2019-19781 ★ 94 · Jan 21, 2020
Indicator of Compromise Scanner for CVE-2019-19781
-
jas502n/CVE-2019-19781 ★ 85 · Jan 11, 2020
Citrix ADC Remote Code Execution
-
citrix/ioc-scanner-CVE-2019-19781 ★ 59 · Jan 21, 2020
Indicator of Compromise Scanner for CVE-2019-19781
-
aqhmal/CVE-2019-19781 ★ 11 · Jan 13, 2020
Automated script for Citrix ADC scanner (CVE-2019-19781) using hosts retrieved from Shodan API. You must have a Shodan account to use this script.
-
w4fz5uck5/CVE-2019-19781-CitrixRCE ★ 10 · Jul 17, 2020
Citrix Unauthorized Remote Code Execution Attacker - CVE-2019-19781
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Citrix ADC and Gateway - Directory Traversal http/cves/2019/CVE-2019-19781.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://support.citrix.com/article/CTX267027
- VU#619785 third-party-advisory
- https://twitter.com/bad_packets/status/1215431625766424576
- https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/
- https://forms.gle/eDf3DXZAv96oosfj6
- http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html
- http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html