Multiple vulnerabilities in Citrix Gateway

Published: 2020-03-08 | Updated: 2020-03-08

Risk	Medium
Patch available	NO
Number of vulnerabilities	3
CVE-ID	CVE-2020-10110 CVE-2020-10112 CVE-2020-10111
CWE-ID	CWE-200 CWE-444
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #3 is available.
Vulnerable software	Citrix NetScaler Gateway Server applications / Application servers
Vendor	Citrix

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

Updated: 08.03.2020

Added vulnerabilities #2-#3, updated bulletin title.

1) Information disclosure

EUVDB-ID: #VU25816

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-10110

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to some responses of the web based solution are handled with an included caching system. A remote attacker can gain unauthorized access to sensitive information stored in cache.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Citrix NetScaler Gateway: 11.1.41.26 - 12.1.55.18

CPE2.3

External links

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-004.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU25817

Risk: Low

CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-10112

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cache poisoning attacks.

The vulnerability exists due to incorrect processing of HTTP requests that rely on HTTP parameter values. If a client is requesting a URL with parameter "value=A", the parameter will be processed and the response will be cached. If another client is requesting the same URL but with a different parameter "value=B", the request will be answered with the initial response ("value=A") during the caching time (for 112 seconds).

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Citrix NetScaler Gateway: 11.1.41.26 - 12.1.55.18

CPE2.3

External links

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-005.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU25818

Risk: Low

CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-10111

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cache poising attacks.

The vulnerability exists due to incorrect processing of HTTP requests with different HTTP protocol versions. A remote attacker can send a specially crafted HTTP request and posing the HTTP cache.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Citrix NetScaler Gateway: 11.1.41.26 - 12.1.55.18

CPE2.3

External links

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-006.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.