CVE-2019-12991 in citrix netscaler sd-wan
LogPulse has assessed this CVE and a detection rule is being built.
What the vulnerability is
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
Affected software: citrix netscaler sd-wan, citrix sd-wan
Scores
- CVSS: 8.8 (high)
- EPSS: 74.07% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-03-25
- Published: 2019-07-16
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Citrix SD-WAN to 10.2.3 or NetScaler SD-WAN to 10.0.8 or later
Patch or upgrade. Upgrading the SD-WAN appliance software fixes the command injection in /cgi-bin/installpatch.cgi (CVE-2019-12991). It also fixes the unauthenticated SQL injection (CVE-2019-12989) that is chained with it to get root access without credentials.
Applies to: Citrix SD-WAN 10.1.x and 10.2.x before 10.2.3; NetScaler SD-WAN 9.x and 10.0.x before 10.0.8 (per Citrix CTX251987 and Tenable TRA-2019-32).
- Find every Citrix/NetScaler SD-WAN appliance (Standard, Premium/Enterprise, WANOP, Center/Orchestrator on premises) and note its software version under Configuration > System Maintenance > Software Upgrade, or on the dashboard.
- Any version older than 10.2.3 (Citrix SD-WAN 10.1.x and 10.2.x) or 10.0.8 (NetScaler SD-WAN 9.x and 10.0.x) is affected.
- Download the fixed release from the Citrix download site: SD-WAN 10.2.3 or later (preferred, or the current supported release), or NetScaler SD-WAN 10.0.8 or later if you have to stay on 10.0.
- Upgrade the SD-WAN Center/MCN first, then stage and activate the new software package on the branch appliances via Configuration > System Maintenance > Software Upgrade (Change Management).
- Until the upgrade is done, restrict the management web interface (HTTPS) to a dedicated management network or admin jump hosts with a firewall rule; never expose it to the internet.
- After the upgrade, confirm the version on each appliance and check the appliance for unknown admin sessions, files in /tmp and unexpected outbound connections, since this CVE is exploited in the wild (CISA KEV).
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.