Multiple Vulnerabilities Found in Citrix SD-WAN Center and SD-WAN Appliances

Tenable Research has discovered multiple critical vulnerabilities in both Citrix SD-WAN Center and the SD-WAN appliance itself that could allow a remote, unauthenticated attacker to compromise the underlying operating systems of each.

• What you need to know: Tenable Research has disclosed four unauthenticated command injections, an unauthenticated directory traversal and one authenticated command injection in Citrix SD-WAN Center. Tenable Research has also disclosed an unauthenticated SQL injection vulnerability and an authenticated command injection vulnerability which can be used in a chained attack to achieve unauthenticated remote command execution.
• What’s the attack vector? In the SD-WAN Center, multiple remote code execution (RCE) vulnerabilities can be exploited without authentication to gain root access. In the SD-WAN appliance, an unauthenticated SQL injection can be used to bypass authentication. When combined with an authenticated command injection, an attacker can achieve unauthenticated RCE.
• What’s the business impact? An attacker could compromise the underlying operating system (OS) of the Citrix SD-WAN Center. The attacker could also exploit some of these vulnerabilities to traverse the target wide-area network (WAN).
• What’s the solution? Citrix has released patches to address the reported vulnerabilities.

Background

On July 2, Citrix released SD-WAN version 10.2.3 to address multiple vulnerabilities found in Citrix SD-WAN Center and SD-WAN appliance. Tenable has released two research advisories [1, 2] to cover the scope of these vulnerabilities. The first of these advisories includes multiple RCE vulnerabilities found in Citrix SD-WAN Center, while the second includes two vulnerabilities which can be combined to achieve unauthenticated RCE in an SD-WAN appliance. (SD-WAN is both the name of the Citrix product line and a generic term to describe any software-defined wide area network.) These vulnerabilities were discovered by Tenable Researcher Chris Lyne.

Wide area networks are increasingly being managed using software-defined technologies such as Citrix SD-WAN (and others). Adoption of the cloud has created a slew of new challenges for IT management and security as organizations host applications and infrastructure in multiple locations (on-prem, private cloud, public cloud). Many organizations are adopting SD-WAN technology to address the challenges created in today’s complex IT world.

According to a report by CTC Technologies, Citrix SD-WAN ranks in the top 5 SD-WAN vendors for 2019. Citrix SD-WAN Center is a management system which allows enterprises to oversee all SD-WAN appliances on their WAN. According to its customer stories page, Citrix has many notable customers worldwide and across multiple industries.

Analysis

Tenable discovered multiple critical vulnerabilities (CVSSv2 10.0 Base Score) in SD-WAN Center. These vulnerabilities can be exploited by a remote, unauthenticated attacker to gain root privileges on the OS. Technically speaking, the vulnerabilities are made up of several command injections and a directory traversal in the SD-WAN Center web application. These vulnerabilities can be exploited by a novice attacker.

Tenable has also discovered multiple vulnerabilities in the SD-WAN appliance. These vulnerabilities can also be exploited by a remote, unauthenticated attacker to gain root privileges on the OS.

Citrix has assigned the following CVEs for the six vulnerabilities in Citrix SD-WAN Center:

• CVE-2019-12985: Unauthenticated Command Injection
• CVE-2019-12986: Unauthenticated Command Injection
• CVE-2019-12987: Unauthenticated Command Injection
• CVE-2019-12988: Unauthenticated Command Injection
• CVE-2019-12990: Unauthenticated Directory Traversal File Write
• CVE-2019-12992: Authenticated Command Injection

The vulnerabilities in the Citrix SD-WAN Appliance received the following CVEs:

• CVE-2019-12989: Unauthenticated SQL Injection
• CVE-2019-12991: Authenticated Command Injection

Proof of concept

Business impact

Given that organizations would use Citrix SD-WAN to manage their networks across geographical regions, the damage potential is extremely high. An attacker is able to not only compromise the underlying OS of Citrix SD-WAN Center, but also gain administrative access to the application itself. This is true for the SD-WAN appliance as well.

The only requirement is that the attacker must be able to reach an instance of either SD-WAN or SD-WAN Center. This requirement would be determined by how the instance is positioned in a network topology. Consequently, the threat actor could range from an insider threat to an external attacker. The likely threat actor profile would depend on the nature of the organization.

If a successful attack were mounted, it could be devastating to any organization. An attacker would have access to all of the SD-WAN Center application’s functionality. This level of access means an attacker could bring down a specific branch location’s connectivity or even an entire WAN. An attacker could also launch a more fine-tuned attack and make specific configuration changes to the SD-WAN. They could also use these vulnerabilities to traverse from appliance to appliance at will.

Solution

Citrix has released a security advisory and patches to address the reported vulnerabilities.

Additional information

• Visit the Tenable Tech Blog on Medium to read researcher Chris Lyne’s in-depth story about his work uncovering these vulnerabilities.
• Citrix SD-WAN Download page (restricted access)
• Tenable Advisory: Citrix SD-WAN Center Multiple Vulnerabilities
• Tenable Advisory: Citrix SD-WAN Appliance Multiple Vulnerabilities

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io.