CVE-2019-12990 — AI Deep Analysis Summary

🚨 **Essence**: Path Traversal in Citrix SD-WAN Center. 📉 **Consequences**: Attackers can access restricted directories outside the intended scope.…

🛡️ **Root Cause**: CWE-22 (Path Traversal). 🐛 **Flaw**: The `applianceSettingsFileTransfer` function in `ApplianceSettingsController` fails to validate or sanitize HTTP request parameters.…

🏢 **Affected Products**: Citrix Systems SD-WAN Center & NetScaler SD-WAN Center. 📅 **Versions**: - SD-WAN Center: 10.2.x versions **before** 10.2.3. - NetScaler SD-WAN Center: 10.0.x versions **before** 10.0.8. ⚠️

🕵️ **Attacker Actions**: 1. Write files to locations writable by `www-data`. 2. Upload crafted PHP files to `/home/talariuser/www/app/webroot/files/`. 3. Execute arbitrary PHP code.…

🔑 **Threshold**: Medium. 📝 **Config**: Exploitation requires routing traffic through the `Collector` controller. The attacker must supply crafted values for `filename`, `filedata`, and `workspace_id`.…

💻 **Public Exp?**: Yes. 📂 **PoC**: Available via Nuclei templates (projectdiscovery/nuclei-templates).…

🔍 **Self-Check**: 1. Scan for affected versions (10.2.x < 10.2.3, 10.0.x < 10.0.8). 2. Use Nuclei templates to test the `applianceSettingsFileTransfer` endpoint. 3.…

🩹 **Official Fix**: Yes. 📦 **Patch**: Citrix released updates. - Upgrade SD-WAN Center to **10.2.3** or later. - Upgrade NetScaler SD-WAN Center to **10.0.8** or later.…

🚧 **No Patch Workaround**: 1. Restrict network access to the `Collector` controller. 2. Implement strict WAF rules to block path traversal sequences (`../`) in `filename`, `filedata`, and `workspace_id` parameters.…

🔥 **Urgency**: HIGH. ⏳ **Priority**: Immediate patching recommended. Since this allows arbitrary code execution (RCE) via PHP upload, the impact is critical. Do not delay upgrading to the fixed versions. 🏃‍♂️💨