Other nomination

SD-PWN Part 2 --- Citrix SD-WAN Center

Ariel Tempelhof · Medium · 15 November 2020

Citrix SD-WAN Center runs CakePHP2, whose URL parser drops everything before a scheme separator that precedes a question mark, so Apache and the framework disagree about the path and the client-certificate restriction on the collector endpoint is bypassed. Chained with an unsanitised path traversal into shell_exec, that yields pre-authentication remote code execution.

Record

Researcher

Ariel Tempelhof

Published by

Medium

Date

15 November 2020

In the archive

• Nominated for the 2020 Top 10 Web Hacking Techniques

Related sources

• Author exploitation script

Tags

• parser-differential
• rce
• auth-bypass
• command-injection
• path-traversal
• url-parsing
• php
• cve
• attack-chain
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Ariel Tempelhof, first published at the original source. Preserved copies are kept so the citation survives its host.