CVE-2020-8193
MEDIUM KEV NUCLEICitrix ADC/Gateway <13.0-58.30 - Info Disclosure
Title source: llmExploitation Summary
CVE-2020-8193 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 5 public exploits from researchers including jas502n, Airboi, PR3R00T. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2020-8193, targeting Citrix ADC. The exploit chains session manipulation and directory traversal to achieve arbitrary file read (LFI).
Description
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
Exploits (5)
This repository contains a functional Python exploit for CVE-2020-8193, targeting Citrix ADC. The exploit chains session manipulation and directory traversal to achieve arbitrary file read (LFI).
This repository contains a functional proof-of-concept exploit for CVE-2020-8193, demonstrating a remote code execution vulnerability in Citrix ADC. The exploit involves a series of HTTP requests to create a session, fix the session, and retrieve a random key, which can be used to achieve RCE.
This repository contains a Python script that scans for CVE-2020-8193, an authentication bypass vulnerability in Citrix ADC. The script checks for the presence of a session cookie after sending a crafted request, indicating potential vulnerability.
This repository provides a detailed technical analysis of CVE-2020-8193, including HTTP request/response examples for session manipulation and LFI exploitation in Citrix ADC/Netscaler. It does not contain functional exploit code but offers in-depth vulnerability research.
This repository contains a functional proof-of-concept exploit for CVE-2020-8193, demonstrating a remote code execution vulnerability in Citrix ADC. The exploit involves a series of HTTP requests to create a session, fix the session, and retrieve a random key, which can be used to achieve RCE.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N