what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

HP ThinPro 6.x / 7.x Citrix Command Injection

HP ThinPro 6.x / 7.x Citrix Command Injection
Posted Mar 25, 2020
Authored by Eldar Marcussen

HP ThinPro versions 7.1, 7.0, 6.2.1, and 6.2 suffer from a Citrix receiver connection wrapper command injection vulnerability.

tags | exploit
advisories | CVE-2019-18909
SHA-256 | eb4c697a97d752e546087c1c92f72f5ac8c5d658671e63bf3352ddfb5a13cb26

HP ThinPro 6.x / 7.x Citrix Command Injection

Change Mirror Download
HP ThinPro - Citrix command injection
===============================================================================

Identifiers
-------------------------------------------------
* CVE-2019-18909

CVSSv3 score
-------------------------------------------------
6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Vendor
-------------------------------------------------
HP - [https://www.hp.com](https://www.hp.com)

Product
-------------------------------------------------
Deliver secure desktop virtualization that’s as comfortable for IT as it is
for end users with the stunningly redesigned HP ThinPro. It has a bold new
user interface and workflow refinements that make it a breeze to configure,
manage, and use right out of the box.

Affected versions
-------------------------------------------------
- HP ThinPro Linux 7.1
- HP ThinPro Linux 7.0
- HP ThinPro Linux 6.2.1
- HP ThinPro Linux 6.2

Credit
-------------------------------------------------
Eldar Marcussen - xen1thLabs - Software Labs

Vulnerability summary
-------------------------------------------------
The Citrix receiver conection wrapper function does not safely handle user
supplied data allowing an unauthenticated attacker to use commandline
syntax to execute arbitrary commands on the device.

Technical details
------------------------------------------------
The user supplied values provided for the domain portion of the login
screens for `Citrix receiver` is vulnerable to command injection, an
unauthenticated attacker can exploit this to execute commands with the
privileges of the local user.

Proof of concept
-------------------------------------------------
The following evidence is provided to illustrate the existence and
exploitation:

1. At the `Citrix receiver` login screen enter the following details:
* username: \pwnt
* password: pwnt
* Domain should be empty
2. Click `Connect`
3. In the `Citrix server details` window, enter the following for domain:
`;xterm;echo `
4. Click `Connect`
5. Observe that xterm spawns

Solution
-------------------------------------------------
Contact vendor for a solution

Timeline
-------------------------------------------------
Date | Status
------------|-----------------------------
19-AUG-2019 | Reported to vendor
22-NOV-2019 | Patch available
24-MAR-2020 | Public disclosure


Login or Register to add favorites

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close