Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure
CVE-2020-8196 is a medium-severity improper authentication vulnerability in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP, with a CVSS 3.1 base score of 4.3 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. CISA added it to the Known Exploited Vulnerabilities catalogue on November 3, 2021, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Update Application Delivery Controller Firmware to 10.5-70.18 or 11.1-64.14 or 12.0-63.21 or 12.1-57.18, whichever matches your release line, or a later version.
- Update Netscaler Gateway Firmware to 10.5-70.18 or 11.1-64.14 or 12.0-63.21 or 12.1-57.18, whichever matches your release line, or a later version.
- Update Gateway Firmware to 13.0-58.30 or a later version.
- CISA's required action: Apply updates per vendor instructions.
- Read the advisory on support.citrix.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP | Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP | Not specified in the record | Not stated |
| Citrix | Application Delivery Controller Firmware | 10.5 up to, but not including, 10.5-70.18; 11.1 up to, but not including, 11.1-64.14; 12.0 up to, but not including, 12.0-63.21; 12.1 up to, but not including, 12.1-57.18; 13.0 up to, but not including, 13.0-58.30 | 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18, 13.0-58.30 |
| Citrix | Netscaler Gateway Firmware | 10.5 up to, but not including, 10.5-70.18; 11.1 up to, but not including, 11.1-64.14; 12.0 up to, but not including, 12.0-63.21; 12.1 up to, but not including, 12.1-57.18 | 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18 |
| Citrix | Gateway Firmware | 13.0 up to, but not including, 13.0-58.30 | 13.0-58.30 |
| Citrix | Sd-wan Wanop | 10.2 up to, but not including, 10.2.7; 11.0 up to, but not including, 11.0.3d; 11.1 up to, but not including, 11.1.1a | 10.2.7, 11.0.3d, 11.1.1a |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- LowSome restricted data can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 4.3 | Medium | NVD |
| CVSS 3.1 | 4.3 | Medium | CISA (ADP) |
| CVSS 2.0 | 4.0 | Medium | NVD |
Official description
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How developers prevent this class of flaw
- Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Timeline
- CVE record published.
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Advisories
Third-party and government advisories
- packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.htmlThird Party Advisory, VDB Entry
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8196US Government Resource
Other vulnerabilities in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
- 6.5 Medium severity
- 6.5 Medium severity
Recent Improper Authentication vulnerabilities
- 9.8 Critical severity
IBM Data Risk Manager Security Bypass Exploited
- 8.8 High severity
- 9.8 Critical severity
Sangoma FreePBX Improper Authentication Exploited
- 7.8 High severity
Microsoft Windows Privilege Escalation Exploited
- 9.8 Critical severity
Dasan GPON Routers Authentication Bypass Exploited
- 9.8 Critical severity
Spotted an error? Tell us.