Citrix Application Delivery Controller/Gateway up to 13.0 path traversal

Summaryinfo

A vulnerability was found in Citrix Application Delivery Controller and Gateway 10.5/11.1/12.0/12.1/13.0. It has been declared as very critical. This affects an unknown function. The manipulation results in path traversal. This vulnerability is cataloged as CVE-2019-19781. The attack may be launched remotely. Furthermore, there is an exploit available. This vulnerability is historically impactful due to its background and the reception it garnered. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Citrix Application Delivery Controller and Gateway 10.5/11.1/12.0/12.1/13.0 (Connectivity Software). It has been classified as very critical. Affected is some unknown processing. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

The weakness was shared 12/27/2019 (Website). The advisory is shared for download at support.citrix.com. This vulnerability is traded as CVE-2019-19781 since 12/13/2019. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/05/2025). The MITRE ATT&CK project declares the attack technique as T1006. This vulnerability has a historic impact due to its background and reception.

A public exploit has been developed by Project Zero India in Bash and been published 3 weeks after the advisory. The exploit is shared for download at github.com. It is declared as attacked. As 0-day the estimated underground price was around $25k-$100k. This issue was added on 11/03/2021 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 05/03/2022:

Apply updates per vendor instructions.

Applying the patch Fix for Citrix ADC and Citrix Gateway is able to eliminate this problem. The bugfix is ready for download at citrix.com. A possible mitigation has been published 4 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47901). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Connectivity Software

Vendor

• Citrix

Name

• Application Delivery Controller
• Gateway

Version

• 10.5
• 11.1
• 12.0
• 12.1
• 13.0

License

• commercial

Website

• Vendor: https://www.citrix.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion