PT-2015-5923 · Citrix · Citrix Netscaler

Cengiz Han Sahin · Published 2015-04-03 · Updated 2018-10-09 · CVE-2015-2838

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Citrix NetScaler versions prior to 10.5 build 52.3nc

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack administrator authentication for requests that execute arbitrary commands as nsroot. This is achieved via shell metacharacters in the file name JSON member in params/xen hotfix/0 to "nitro/v1/config/xen hotfix" API endpoint.

Recommendations For versions prior to 10.5 build 52.3nc, update to build 52.3nc or later to resolve the issue. As a temporary workaround, consider restricting access to the "nitro/v1/config/xen hotfix" API endpoint to minimize the risk of exploitation. Avoid using the file name JSON member in the affected API endpoint until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-2838

Affected Products

Citrix Netscaler

References · 8

• 🔥 https://securify.nl/advisory/SFY20140806/command_injection_vulnerability_in_citrix_nitro_sdk_xen_hotfix_page.html · Exploit
• 🔥 https://exploit-db.com/exploits/36442 · Exploit
• 🔥 http://packetstormsecurity.com/files/130937/Citrix-NITRO-SDK-Command-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2838 · Security Note
• http://securityfocus.com/bid/73358 · Note
• http://seclists.org/fulldisclosure/2015/Mar/129 · Note
• http://securityfocus.com/archive/1/534936/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2838 · Note