CNVD-2024-17820

Vulnerability from cnvd - Published: 2024-04-12
VLAI
Title
Citrix NetScaler ADC和NetScaler Gateway存在代码注入漏洞
Description
NetScaler ADC是一种应用程序交付控制器。NetScaler Gateway是一款具有SSL VPN解决方案的访问网关,可为网络资产的远程最终用户提供单点登录和身份验证。两者均为Citrix旗下的产品。 Citrix NetScaler ADC和NetScaler Gateway存在代码注入漏洞,漏洞源于NetScaler ADC and NetScaler Gateway中的代码生成控制不当。具有管理界面的NSIP、CLIP或SNIP访问权限的攻击者,可利用漏洞在管理界面上执行经过身份验证(低权限)的远程代码执行。
Severity
Patch Name
Citrix NetScaler ADC和NetScaler Gateway存在代码注入漏洞的补丁
Patch Description
NetScaler ADC是一种应用程序交付控制器。NetScaler Gateway是一款具有SSL VPN解决方案的访问网关,可为网络资产的远程最终用户提供单点登录和身份验证。两者均为Citrix旗下的产品。 Citrix NetScaler ADC和NetScaler Gateway存在代码注入漏洞,漏洞源于NetScaler ADC and NetScaler Gateway中的代码生成控制不当。具有管理界面的NSIP、CLIP或SNIP访问权限的攻击者,可利用漏洞在管理界面上执行经过身份验证(低权限)的远程代码执行。目前,供应商发布了安全公告及相关补丁信息,修复了此漏洞。
Formal description

目前厂商已发布升级补丁以修复漏洞,补丁获取链接: https://www.citrix.com/downloads/

Reference
https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549https://cxsecurity.com/cveshow/CVE-2023-6548/https://nvd.nist.gov/vuln/detail/CVE-2023-6548
Impacted products
Name
['Citrix Systems, Inc. NetScaler Gateway >=13.0,<13.0-92.21', 'Citrix Systems, Inc. NetScaler Gateway >=13.1,<13.1-51.15', 'Citrix Systems, Inc. NetScaler Gateway >=14.1,<14.1-12.35', 'Citrix Systems, Inc. NetScaler Application Delivery Controller >=12.1,<12.1-55.302', 'Citrix Systems, Inc. NetScaler Application Delivery Controller >=13.1,<13.1-37.176', 'Citrix Systems, Inc. NetScaler Application Delivery Controller >=13.0,<13.0-92.21', 'Citrix Systems, Inc. NetScaler Application Delivery Controller >=13.1,<13.1-51.15', 'Citrix Systems, Inc. NetScaler Application Delivery Controller >=14.1,<14.1-12.35']
Show details on source website

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-6548",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-6548"
    }
  },
  "description": "NetScaler ADC\u662f\u4e00\u79cd\u5e94\u7528\u7a0b\u5e8f\u4ea4\u4ed8\u63a7\u5236\u5668\u3002NetScaler Gateway\u662f\u4e00\u6b3e\u5177\u6709SSL VPN\u89e3\u51b3\u65b9\u6848\u7684\u8bbf\u95ee\u7f51\u5173\uff0c\u53ef\u4e3a\u7f51\u7edc\u8d44\u4ea7\u7684\u8fdc\u7a0b\u6700\u7ec8\u7528\u6237\u63d0\u4f9b\u5355\u70b9\u767b\u5f55\u548c\u8eab\u4efd\u9a8c\u8bc1\u3002\u4e24\u8005\u5747\u4e3aCitrix\u65d7\u4e0b\u7684\u4ea7\u54c1\u3002\n\nCitrix NetScaler ADC\u548cNetScaler Gateway\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\uff0c\u6f0f\u6d1e\u6e90\u4e8eNetScaler ADC and NetScaler Gateway\u4e2d\u7684\u4ee3\u7801\u751f\u6210\u63a7\u5236\u4e0d\u5f53\u3002\u5177\u6709\u7ba1\u7406\u754c\u9762\u7684NSIP\u3001CLIP\u6216SNIP\u8bbf\u95ee\u6743\u9650\u7684\u653b\u51fb\u8005\uff0c\u53ef\u5229\u7528\u6f0f\u6d1e\u5728\u7ba1\u7406\u754c\u9762\u4e0a\u6267\u884c\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\uff08\u4f4e\u6743\u9650\uff09\u7684\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.citrix.com/downloads/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-17820",
  "openTime": "2024-04-12",
  "patchDescription": "NetScaler ADC\u662f\u4e00\u79cd\u5e94\u7528\u7a0b\u5e8f\u4ea4\u4ed8\u63a7\u5236\u5668\u3002NetScaler Gateway\u662f\u4e00\u6b3e\u5177\u6709SSL VPN\u89e3\u51b3\u65b9\u6848\u7684\u8bbf\u95ee\u7f51\u5173\uff0c\u53ef\u4e3a\u7f51\u7edc\u8d44\u4ea7\u7684\u8fdc\u7a0b\u6700\u7ec8\u7528\u6237\u63d0\u4f9b\u5355\u70b9\u767b\u5f55\u548c\u8eab\u4efd\u9a8c\u8bc1\u3002\u4e24\u8005\u5747\u4e3aCitrix\u65d7\u4e0b\u7684\u4ea7\u54c1\u3002\r\n\r\nCitrix NetScaler ADC\u548cNetScaler Gateway\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\uff0c\u6f0f\u6d1e\u6e90\u4e8eNetScaler ADC and NetScaler Gateway\u4e2d\u7684\u4ee3\u7801\u751f\u6210\u63a7\u5236\u4e0d\u5f53\u3002\u5177\u6709\u7ba1\u7406\u754c\u9762\u7684NSIP\u3001CLIP\u6216SNIP\u8bbf\u95ee\u6743\u9650\u7684\u653b\u51fb\u8005\uff0c\u53ef\u5229\u7528\u6f0f\u6d1e\u5728\u7ba1\u7406\u754c\u9762\u4e0a\u6267\u884c\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\uff08\u4f4e\u6743\u9650\uff09\u7684\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Citrix NetScaler ADC\u548cNetScaler Gateway\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Citrix Systems, Inc. NetScaler Gateway \u003e=13.0\uff0c\u003c13.0-92.21",
      "Citrix Systems, Inc. NetScaler Gateway \u003e=13.1\uff0c\u003c13.1-51.15",
      "Citrix Systems, Inc. NetScaler Gateway \u003e=14.1\uff0c\u003c14.1-12.35",
      "Citrix Systems, Inc. NetScaler Application Delivery Controller \u003e=12.1\uff0c\u003c12.1-55.302",
      "Citrix Systems, Inc. NetScaler Application Delivery Controller \u003e=13.1\uff0c\u003c13.1-37.176",
      "Citrix Systems, Inc. NetScaler Application Delivery Controller \u003e=13.0\uff0c\u003c13.0-92.21",
      "Citrix Systems, Inc. NetScaler Application Delivery Controller \u003e=13.1\uff0c\u003c13.1-51.15",
      "Citrix Systems, Inc. NetScaler Application Delivery Controller \u003e=14.1\uff0c\u003c14.1-12.35"
    ]
  },
  "referenceLink": "https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549https://cxsecurity.com/cveshow/CVE-2023-6548/https://nvd.nist.gov/vuln/detail/CVE-2023-6548",
  "serverity": "\u9ad8",
  "submitTime": "2024-02-22",
  "title": "Citrix NetScaler ADC\u548cNetScaler Gateway\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…