Remote code execution in Citrix CloudBridge and Citrix NetScaler SD-WAN - CVE-2017-6316

Vulnerability identifier: #VU7606

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-6316

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote authenticated user to execute arbitrary code on the target system.

The weakness exists in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition due to insufficient sanitization of user-supplied input. A remote attacker can use CGISESSID cookies to execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

Citrix CloudBridge
Citrix NetScaler SD-WAN

Update to version 9.1.2.26.561201.
https://www.citrix.com/downloads/netscaler-sd-wan/?_ga=2.7838130.1074911473.1501502922-215775083.133...

• Exploit #1269 - Citrix CloudBridge - 'CAKEPHP' Cookie Command Injection (March 18, 2020)
• Exploit #1270 - Netscaler SD-WAN 9.1.2.26.561201 - Command Injection (Metasploit) (March 18, 2020)

• https://support.citrix.com/article/CTX225990

• Remote code execution in Citrix NetScaler SD-WAN