Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable 博客

订阅

Citrix SD-WAN 中心和 SD-WAN 设备中发现多个漏洞

Tenable Research has discovered multiple critical vulnerabilities in both Citrix SD-WAN Center and the SD-WAN appliance itself that could allow a remote, unauthenticated attacker to compromise the underlying operating systems of each.

  • What you need to know: Tenable Research has disclosed four unauthenticated command injections, an unauthenticated directory traversal and one authenticated command injection in Citrix SD-WAN Center. Tenable Research has also disclosed an unauthenticated SQL injection vulnerability and an authenticated command injection vulnerability which can be used in a chained attack to achieve unauthenticated remote command execution.
  • What’s the attack vector? In the SD-WAN Center, multiple remote code execution (RCE) vulnerabilities can be exploited without authentication to gain root access. In the SD-WAN appliance, an unauthenticated SQL injection can be used to bypass authentication. When combined with an authenticated command injection, an attacker can achieve unauthenticated RCE.
  • What’s the business impact? An attacker could compromise the underlying operating system (OS) of the Citrix SD-WAN Center. The attacker could also exploit some of these vulnerabilities to traverse the target wide-area network (WAN).
  • What’s the solution? Citrix has released patches to address the reported vulnerabilities.

背景

On July 2, Citrix released SD-WAN version 10.2.3 to address multiple vulnerabilities found in Citrix SD-WAN Center and SD-WAN appliance. Tenable has released two research advisories [1, 2] to cover the scope of these vulnerabilities. The first of these advisories includes multiple RCE vulnerabilities found in Citrix SD-WAN Center, while the second includes two vulnerabilities which can be combined to achieve unauthenticated RCE in an SD-WAN appliance. (SD-WAN is both the name of the Citrix product line and a generic term to describe any software-defined wide area network.) These vulnerabilities were discovered by Tenable Researcher Chris Lyne.

Wide area networks are increasingly being managed using software-defined technologies such as Citrix SD-WAN (and others). Adoption of the cloud has created a slew of new challenges for IT management and security as organizations host applications and infrastructure in multiple locations (on-prem, private cloud, public cloud). Many organizations are adopting SD-WAN technology to address the challenges created in today’s complex IT world.

According to a report by CTC Technologies, Citrix SD-WAN ranks in the top 5 SD-WAN vendors for 2019. Citrix SD-WAN Center is a management system which allows enterprises to oversee all SD-WAN appliances on their WAN. According to its customer stories page, Citrix has many notable customers worldwide and across multiple industries.

分析

Tenable discovered multiple critical vulnerabilities (CVSSv2 10.0 Base Score) in SD-WAN Center. These vulnerabilities can be exploited by a remote, unauthenticated attacker to gain root privileges on the OS. Technically speaking, the vulnerabilities are made up of several command injections and a directory traversal in the SD-WAN Center web application. These vulnerabilities can be exploited by a novice attacker.

Tenable has also discovered multiple vulnerabilities in the SD-WAN appliance. These vulnerabilities can also be exploited by a remote, unauthenticated attacker to gain root privileges on the OS.

Citrix has assigned the following CVEs for the six vulnerabilities in Citrix SD-WAN Center:

  • CVE-2019-12985: Unauthenticated Command Injection
  • CVE-2019-12986: Unauthenticated Command Injection
  • CVE-2019-12987: Unauthenticated Command Injection
  • CVE-2019-12988: Unauthenticated Command Injection
  • CVE-2019-12990: Unauthenticated Directory Traversal File Write
  • CVE-2019-12992: Authenticated Command Injection

The vulnerabilities in the Citrix SD-WAN Appliance received the following CVEs:

  • CVE-2019-12989: Unauthenticated SQL Injection
  • CVE-2019-12991: Authenticated Command Injection

概念验证

Business impact

Given that organizations would use Citrix SD-WAN to manage their networks across geographical regions, the damage potential is extremely high. An attacker is able to not only compromise the underlying OS of Citrix SD-WAN Center, but also gain administrative access to the application itself. This is true for the SD-WAN appliance as well.

The only requirement is that the attacker must be able to reach an instance of either SD-WAN or SD-WAN Center. This requirement would be determined by how the instance is positioned in a network topology. Consequently, the threat actor could range from an insider threat to an external attacker. The likely threat actor profile would depend on the nature of the organization.

If a successful attack were mounted, it could be devastating to any organization. An attacker would have access to all of the SD-WAN Center application’s functionality. This level of access means an attacker could bring down a specific branch location’s connectivity or even an entire WAN. An attacker could also launch a more fine-tuned attack and make specific configuration changes to the SD-WAN. They could also use these vulnerabilities to traverse from appliance to appliance at will.

解决方案

Citrix has released a security advisory and patches to address the reported vulnerabilities.

Additional information

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io.

相关文章

您可加以利用的网络安全新闻

输入您的电子邮件,绝不要错过 Tenable 专家的及时提醒和安全指导。

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。

Tenable Vulnerability Management 试用版还包含 Tenable Lumin 和 Tenable Web App Scanning。

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

100 项资产

选择您的订阅选项:

立即购买

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。

Tenable Vulnerability Management 试用版还包含 Tenable Lumin 和 Tenable Web App Scanning。

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

100 项资产

选择您的订阅选项:

立即购买

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。

Tenable Vulnerability Management 试用版还包含 Tenable Lumin 和 Tenable Web App Scanning。

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

100 项资产

选择您的订阅选项:

立即购买

试用 Tenable Web App Scanning

您可以通过 Tenable One 风险暴露管理平台完全访问我们专为现代应用程序量身打造的最新 Web 应用程序扫描产品。可安全扫描全部在线资产组合的漏洞,具有高度准确性,而且无需繁重的手动操作或中断关键的 Web 应用程序。立即注册。

Tenable Web App Scanning 试用版还包含 Tenable Vulnerability Management 和 Tenable Lumin。

购买 Tenable Web App Scanning

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

5 个 FQDN

$3,578

立即购买

试用 Tenable Lumin

使用 Tenable Lumin 直观呈现及探索您的风险暴露管理,长期追踪风险降低状况,并比照同行业者进行基准衡量。

Tenable Lumin 试用版还包括 Tenable Vulnerability Management 和 Tenable Web App Scanning。

购买 Tenable Lumin

联系销售代表,了解 Tenable Lumin 如何帮助您获取整个企业的洞见并管理网络安全风险。

免费试用 Tenable Nessus Professional

免费试用 7 天

Tenable Nessus 是当今市场上功能最全面的漏洞扫描器。

新 - Tenable Nessus Expert
不可用

Nessus Expert 添加了更多功能,包括外部攻击面扫描,以及添加域和扫描云基础设施的功能。单击此处试用 Nessus Expert。

填写下面的表格可继续试用 Nessus Pro。

购买 Tenable Nessus Professional

Tenable Nessus 是当今市场上功能最全面的漏洞扫描器。Tenable Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并调动起 IT 团队的积极性。

购买多年期许可,即享优惠价格添加高级支持功能,获取一年 365 天、一天 24 小时的电话、社区和聊天支持。

选择您的许可证

购买多年期许可,即享优惠价格

添加支持和培训

免费试用 Tenable Nessus Expert

免费试用 7 天

Nessus Expert 针对现代攻击面而量身打造,可以查看更多信息,保护企业免遭从 IT 到云中漏洞的攻击。

已经有 Tenable Nessus Professional?
升级到 Nessus Expert,免费试用 7 天。

购买 Tenable Nessus Expert

Nessus Expert 针对现代攻击面而量身打造,可以查看更多信息,保护企业免遭从 IT 到云中漏洞的攻击。

选择您的许可证

购买多年许可证,节省幅度更大。

添加支持和培训