PT-2018-1053 · Citrix · Citrix Netscaler Vpx

Buxuqua · Published 2018-01-02 · Updated 2018-03-03 · CVE-2018-6186

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Citrix NetScaler VPX versions prior to NS12.0 53.13.nc

Description The issue is related to insufficient validation of incoming requests in Citrix NetScaler, allowing a remote attacker with webapp privileges to exploit the vulnerability. This can lead to access to the nsroot account and execution of arbitrary commands with root privileges via Server-Side Request Forgery (SSRF) attacks using the "/rapi/read url" API endpoint.

Recommendations For Citrix NetScaler VPX versions prior to NS12.0 53.13.nc, consider restricting access to the /rapi/read url URI to prevent SSRF attacks until a patch is available. As a temporary workaround, limit the privileges of webapp accounts to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2018-00366

CVE-2018-6186

Affected Products

Citrix Netscaler Vpx

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-6186 · Security Note
• https://bdu.fstec.ru/vul/2018-00366 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6186 · Vendor Advisory
• http://securitytracker.com/id/1040440 · Note
• http://securityfocus.com/bid/102915 · Note
• https://gist.github.com/buxu/04ce809eb8b32ef57e232eab5e61f023 · Note
• https://support.citrix.com/article/CTX232161 · Note