Remote code execution in Citrix NetScaler SD-WAN

1) Remote code execution

EUVDB-ID: #VU7606

Risk: High

CVSSv3.1: 9.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2017-6316

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: Yes

Description

The vulnerability allows a remote authenticated user to execute arbitrary code on the target system.

The weakness exists in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition due to insufficient sanitization of user-supplied input. A remote attacker can use CGISESSID cookies to execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update to version 9.1.2.26.561201.
https://www.citrix.com/downloads/netscaler-sd-wan/?_ga=2.7838130.1074911473.1501502922-215775083.133...

Vulnerable software versions

Citrix CloudBridge: 8.0

Citrix NetScaler SD-WAN: 8.1 - 9.1

External links

http://support.citrix.com/article/CTX225990

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to open a a specially crafted file.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.