CVE-2019-19781 Scanner

Citrix Application Delivery Controller (ADC) and Citrix Gateway are widely deployed in enterprise environments to manage and secure application delivery. The ADC provides advanced load balancing, traffic management, and application acceleration, while the Gateway enables secure remote access for users. These devices are critical for maintaining business continuity and ensuring that employees can access internal resources from anywhere. Their widespread use makes them a prime target for attackers seeking to compromise enterprise networks.

CVE-2019-19781 is a directory traversal vulnerability that affects Citrix ADC and Gateway versions 10.5, 11.1, 12.0, 12.1, and 13.0. The flaw arises from improper input validation in the VPN portal component, allowing an unauthenticated attacker to traverse directories and execute arbitrary commands. This vulnerability was discovered in late 2019 and quickly became a major security concern due to its ease of exploitation and critical impact.

Specifically, the vulnerability resides in the /vpns/portal/scripts/ endpoint, where the 'title' parameter is not properly sanitized. By crafting a malicious HTTP request with path traversal sequences (e.g., ../), an attacker can access sensitive files outside the intended directory. This can lead to remote code execution by uploading malicious scripts or modifying configuration files, all without requiring any authentication.

If exploited, CVE-2019-19781 can have devastating consequences for an organization. Attackers can gain full control over the affected device, steal sensitive data such as user credentials and VPN configurations, and use the compromised system as a pivot point to attack internal networks. The high CVSS score of 9.8 reflects the critical nature of this vulnerability, which has been actively exploited in the wild since its disclosure.