Multiple Vulnerabilities Found in Citrix SD-WAN Center and SD-WAN Appliances

Tenable Research

Tenable Research has discovered multiple critical vulnerabilities in both Citrix SD-WAN Center and the SD-WAN appliance itself that could allow a remote, unauthenticated attacker to compromise the underlying operating systems of each.

  • What you need to know: Tenable Research has disclosed four unauthenticated command injections, an unauthenticated directory traversal and one authenticated command injection in Citrix SD-WAN Center. Tenable Research has also disclosed an unauthenticated SQL injection vulnerability and an authenticated command injection vulnerability which can be used in a chained attack to achieve unauthenticated remote command execution.
  • What’s the attack vector? In the SD-WAN Center, multiple remote code execution (RCE) vulnerabilities can be exploited without authentication to gain root access. In the SD-WAN appliance, an unauthenticated SQL injection can be used to bypass authentication. When combined with an authenticated command injection, an attacker can achieve unauthenticated RCE.
  • What’s the business impact? An attacker could compromise the underlying operating system (OS) of the Citrix SD-WAN Center. The attacker could also exploit some of these vulnerabilities to traverse the target wide-area network (WAN).
  • What’s the solution? Citrix has released patches to address the reported vulnerabilities.

Background

On July 2, Citrix released SD-WAN version 10.2.3 to address multiple vulnerabilities found in Citrix SD-WAN Center and SD-WAN appliance. Tenable has released two research advisories [1, 2] to cover the scope of these vulnerabilities. The first of these advisories includes multiple RCE vulnerabilities found in Citrix SD-WAN Center, while the second includes two vulnerabilities which can be combined to achieve unauthenticated RCE in an SD-WAN appliance. (SD-WAN is both the name of the Citrix product line and a generic term to describe any software-defined wide area network.) These vulnerabilities were discovered by Tenable Researcher Chris Lyne.

Wide area networks are increasingly being managed using software-defined technologies such as Citrix SD-WAN (and others). Adoption of the cloud has created a slew of new challenges for IT management and security as organizations host applications and infrastructure in multiple locations (on-prem, private cloud, public cloud). Many organizations are adopting SD-WAN technology to address the challenges created in today’s complex IT world.

According to a report by CTC Technologies, Citrix SD-WAN ranks in the top 5 SD-WAN vendors for 2019. Citrix SD-WAN Center is a management system which allows enterprises to oversee all SD-WAN appliances on their WAN. According to its customer stories page, Citrix has many notable customers worldwide and across multiple industries.

Analysis

Tenable discovered multiple critical vulnerabilities (CVSSv2 10.0 Base Score) in SD-WAN Center. These vulnerabilities can be exploited by a remote, unauthenticated attacker to gain root privileges on the OS. Technically speaking, the vulnerabilities are made up of several command injections and a directory traversal in the SD-WAN Center web application. These vulnerabilities can be exploited by a novice attacker.

Tenable has also discovered multiple vulnerabilities in the SD-WAN appliance. These vulnerabilities can also be exploited by a remote, unauthenticated attacker to gain root privileges on the OS.

Citrix has assigned the following CVEs for the six vulnerabilities in Citrix SD-WAN Center:

  • CVE-2019-12985: Unauthenticated Command Injection
  • CVE-2019-12986: Unauthenticated Command Injection
  • CVE-2019-12987: Unauthenticated Command Injection
  • CVE-2019-12988: Unauthenticated Command Injection
  • CVE-2019-12990: Unauthenticated Directory Traversal File Write
  • CVE-2019-12992: Authenticated Command Injection

The vulnerabilities in the Citrix SD-WAN Appliance received the following CVEs:

  • CVE-2019-12989: Unauthenticated SQL Injection
  • CVE-2019-12991: Authenticated Command Injection

Proof of concept

Business impact

Given that organizations would use Citrix SD-WAN to manage their networks across geographical regions, the damage potential is extremely high. An attacker is able to not only compromise the underlying OS of Citrix SD-WAN Center, but also gain administrative access to the application itself. This is true for the SD-WAN appliance as well.

The only requirement is that the attacker must be able to reach an instance of either SD-WAN or SD-WAN Center. This requirement would be determined by how the instance is positioned in a network topology. Consequently, the threat actor could range from an insider threat to an external attacker. The likely threat actor profile would depend on the nature of the organization.

If a successful attack were mounted, it could be devastating to any organization. An attacker would have access to all of the SD-WAN Center application’s functionality. This level of access means an attacker could bring down a specific branch location’s connectivity or even an entire WAN. An attacker could also launch a more fine-tuned attack and make specific configuration changes to the SD-WAN. They could also use these vulnerabilities to traverse from appliance to appliance at will.

Solution

Citrix has released a security advisory and patches to address the reported vulnerabilities.

Additional information

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io.

Read more >

Published on Jul 11, 2019

People also viewed

Enterprise Territory Manager - Chicago

Chicago Illinois United States Chicago, Illinois, United States Sales Sales
Your Role:Tenable is currently searching for an Enterprise Territory Manager. The Enterprise Territory Manager (ETM) is responsible for establishing and developing business through existing and new clients in an assigned territory.Your Opportunity...

Enterprise Territory Manager - Chicago

Milwaukee Wisconsin United States Milwaukee, Wisconsin, United States Sales Sales
Your Role:Tenable is currently searching for an Enterprise Territory Manager. The Enterprise Territory Manager (ETM) is responsible for establishing and developing business through existing and new clients in an assigned territory.Your Opportunity...

Software Engineer - Web Scraping (Python)

Remote United States Remote, United States, 97458 Research Engineering
Your Role:Tenable is looking for a Software Engineer to join our Automation research team.  This position will involve building and maintaining our framework for automated content creation, validation, and deliveryYour Opportunity: Impact: You wi...

Product Security Architect - Security Development Lifecycle

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Information Security IT
Your Role:As part of the Information Security team, the Principal Product Security Architect will help drive and coordinate security for Tenable’s applications and services portfolio. This includes designing and working on Security Development Lif...

Software Engineer

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Engineering Engineering
Your Role:Are you excited about the opportunity to work with microservices at scale? Do you like knowing that the changes that you deploy to production will improve the customer experience of many users worldwide? Do you like both the exciting, fa...

Software Engineering Manager, UI

San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Engineering Engineering
Your Role:Tenable is looking for an extraordinary Engineering Manager to join the Tenable.io Engineering team. This is an opportunity to make a high impact while helping the team deliver on a next-generation enterprise web application. The ideal c...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.