Following active exploitation against F5 BIG-IP devices, exploit attempts targeting newly disclosed vulnerabilities in Citrix products have begun, which include potential extraction of VPN sessions on vulnerable targets.

CVE-2020-8193, CVE-2020-8195, and CVE-2020-8196: Active Exploitation of Citrix Vulnerabilities

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.

The remote Citrix SD-WAN WANOP device is version 10.2.x prior to 10.2.7, 11.0.x prior to 11.0.3d, 11.1.x prior to 11.1.1a. It is, therefore, affected by multiple vulnerabilities:

  - An authorization bypass vulnerability exists in Citrix SD-WAN WANOP devices. An unauthenticated, remote     attacker with access to the NSIP/management interface can exploit this issue to bypass authorization.     (CVE-2020-8193)

  - A code injection vulnerability exists in Citrix SD-WAN WANOP devices. An unauthenticated, remote attacker     with access to the NSIP/management interface can exploit this issue to create a malicious file which, if     executed by a victim on the management network, could allow the attacker arbitrary code execution in the     context of that user. (CVE-2020-8194)

  - A cross-site scripting vulnerability exists in Citrix SD-WAN WANOP devices. An unauthenticated, remote     attacker can exploit this issue by convincing a user to click a specially crafted URL, to execute     arbitrary script code in a user's browser session. (CVE-2020-8191, CVE-2020-8198)

In addition, Citrix SD-WAN WANOP devices are also affected by several additional vulnerabilities including configuration-dependent privilege escalations, information disclosures, and a denial of service (DoS) vulnerability.
Please refer to advisory CTX276688 for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Citrix ADC or Citrix NetScaler Gateway SSL VPN running on the remote web server is affected by an authorization bypass vulnerability. An unauthenticated remote attacker with access to the NSIP/management interface can exploit this to bypass authorization.

Please refer to advisory CTX276688 for more information.

The remote Citrix ADC or Citrix NetScaler Gateway device is version 10.5.x prior to 10.5-70.18, 11.1.x prior to 11.1-64.14, 12.0.x prior to 12.0-63.21, 12.1.x prior to 12.1-57.18, 12.1-FIPS prior to 12.1-55.179 or 13.0.x prior to 13.0-58.30.
It is, therefore, affected by multiple vulnerabilities:

  - An authorization bypass vulnerability exists in Citrix ADC and NetScaler Gateway devices. An     unauthenticated remote attacker with access to the NSIP/management interface can exploit this to bypass     authorization. (CVE-2020-8193)

  - A code injection vulnerability exists in Citrix ADC and NetScaler Gateway devices. An unauthenticated     remote attacker with access to the NSIP/management interface can exploit this to create a malicious file     which, if executed by a victim on the management network, could allow the attacker arbitrary code execution     in the context of that user. (CVE-2020-8194)

  - A cross-site scripting vulnerability exists in Citrix ADC and NetScaler Gateway devices. An     unauthenticated remote attacker can exploit this convincing a user to click a specially crafted URL, to     execute arbitrary script code in a user's browser session. (CVE-2020-8191, CVE-2020-8198)

In addition, Citrix ADC and Citrix NetScaler Gateway are also affected by several additional vulnerabilities including configuration-dependent privilege escalations, information disclosures, and a denial of service vulnerability.

Please refer to advisory CTX276688 for more information.

ID	Name	Product	Family	Severity
140192	Citrix SD-WAN WANOP 10.2.x Multiple Vulnerabilities (CTX276688)	Nessus	CGI abuses	medium
139082	Citrix ADC and Citrix NetScaler Gateway Multiple Vulnerabilities (CTX276688) (Direct Check)	Nessus	CGI abuses	medium
138212	Citrix ADC and Citrix NetScaler Gateway Multiple Vulnerabilities (CTX276688)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2020-8193

medium

Tenable Plugins

medium

medium

high