CVE-2020-8193
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
Description
CVE-2020-8193 is a MEDIUM-severity authorization bypass vulnerability in Citrix ADC (Application Delivery Controller), Citrix Gateway, and Citrix SD-WAN WANOP appliance models, carrying a CVSS 3.1 score of 6.5. The vulnerability is caused by improper access control that allows unauthenticated access to certain URL endpoints. An attacker must have access to the NetScaler IP (NSIP) to exploit the vulnerability. Affected products include Citrix ADC firmware (versions 10.5 through 13.0), Citrix NetScaler Gateway firmware (versions 10.5 through 12.1), Citrix Gateway firmware (13.0), and Citrix SD-WAN WANOP (versions 10.2 through 11.1). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.94105 (99.91st percentile) indicates extremely high real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | application delivery controller firmware | >= 10.5, < 10.5-70.18; >= 11.1, < 11.1-64.14; >= 12.0, < 12.0-63.21; >= 12.1, < 12.1-57.18; >= 13.0, < 13.0-58.30 |
| citrix | netscaler gateway firmware | >= 10.5, < 10.5-70.18; >= 11.1, < 11.1-64.14; >= 12.0, < 12.0-63.21; >= 12.1, < 12.1-57.18 |
| citrix | gateway firmware | >= 13.0, < 13.0-58.30 |
| citrix | sd-wan wanop | >= 10.2, < 10.2.7; >= 11.0, < 11.0.3d; >= 11.1, < 11.1.1a |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html(Exploit, Third Party Advisory, VDB Entry)
- https://support.citrix.com/article/CTX276688(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8193(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2020-8193 is classified under CWE-284 — Improper Access Control and CWE-287 — Improper Authentication. Improper authentication occurs when an actor claims to have a given identity but the software does not properly verify that claim. Improper access control occurs when software does not properly restrict access to resources from unauthorized actors.
In the context of Citrix ADC and Gateway, the authorization bypass allows unauthenticated attackers to access URL endpoints that should require authentication. This affects the management interface accessible via the NetScaler IP (NSIP). The Citrix ADC and Gateway are critical network infrastructure components that handle load balancing, SSL offloading, VPN access, and application delivery for enterprise environments. An authorization bypass on these devices can expose sensitive management functions and configuration data to unauthorized users.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2020-8193 carries a CVSS 3.1 score of 6.5 (MEDIUM) with Unchanged Scope.
Confidentiality (LOW): Successful exploitation allows limited information disclosure through access to URL endpoints that should require authentication. The exposed information may include device configuration details and status information.
Integrity (LOW): The authorization bypass may allow limited unauthorized modifications through the exposed endpoints, potentially affecting device configuration or operational parameters.
Availability (NONE): The vulnerability does not directly impact the availability of affected devices.
Scope Unchanged: The impact is contained within the vulnerable Citrix ADC, Gateway, or SD-WAN WANOP component.
With an EPSS score of 0.94105 (99.91st percentile), CVE-2020-8193 demonstrates extremely high real-world exploitation despite its MEDIUM severity rating. The vulnerability is often chained with other Citrix vulnerabilities (such as CVE-2020-8195 and CVE-2020-8196) for greater impact.
Exploit Maturity
CVE-2020-8193 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Public exploits are available, including on PacketStorm. The vulnerability is commonly exploited in combination with other Citrix vulnerabilities disclosed in the same advisory (CTX276688), including CVE-2020-8195 and CVE-2020-8196, to achieve greater impact. Exploit chains targeting Citrix infrastructure are well-documented.
Ransomware association: No direct ransomware association has been confirmed for CVE-2020-8193. However, Citrix ADC and Gateway devices are high-value targets and authorization bypass vulnerabilities are commonly used as initial access vectors in broader attack campaigns.
Attack surface: The vulnerability requires access to the NetScaler IP (NSIP), which is typically accessible from the management network. In some deployments, this interface may be reachable from the internet. The wide range of affected product versions — spanning five major Citrix ADC releases and three SD-WAN WANOP releases — means a large installed base is potentially vulnerable.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. All organizations running affected Citrix products should apply patches immediately.
Remediation
- Apply vendor patches immediately. Update to Citrix ADC 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, or 10.5-70.18. For SD-WAN WANOP, update to 11.1.1a, 11.0.3d, or 10.2.7. Consult Citrix support article CTX276688 for detailed guidance.
- Identify all affected appliances. Audit your environment for all Citrix ADC, Gateway, and SD-WAN WANOP appliances. Verify software versions to determine vulnerability status.
- Restrict NSIP access. Ensure the NetScaler IP (NSIP) management interface is only accessible from a dedicated management network. Block NSIP access from untrusted networks and the internet.
- Monitor for exploitation attempts. Deploy detection rules for unauthorized access to management endpoints. Review access logs for the management interface for anomalous requests from unexpected sources.
- Check for chained exploitation. CVE-2020-8193 is commonly exploited alongside CVE-2020-8195 and CVE-2020-8196. Ensure all related vulnerabilities from the CTX276688 advisory are addressed.
- Conduct post-patch verification. After applying updates, verify the patch is effective by testing that previously accessible endpoints now require proper authentication.
Technical Details
CVE-2020-8193 is a MEDIUM-severity authorization bypass vulnerability exploitable over the network with low attack complexity. No authentication or user interaction is required.
Technical mechanism: Citrix ADC and Gateway fail to properly enforce access controls on certain URL endpoints accessible through the NetScaler IP (NSIP). An unauthenticated attacker can send requests to these endpoints and receive responses that should only be available to authenticated administrators. The vulnerability is often used as part of an exploit chain with CVE-2020-8195 (information disclosure) to achieve a more significant compromise.
CVSS 3.1 vector analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N): The network-based attack vector with no privileges required and no user interaction required makes this easily exploitable remotely. The LOW impacts on confidentiality and integrity reflect the limited but meaningful access gained through the authorization bypass.
Affected products: Citrix ADC firmware (10.5 through 13.0), Citrix NetScaler Gateway firmware (10.5 through 12.1), Citrix Gateway firmware (13.0), and Citrix SD-WAN WANOP (10.2 through 11.1). The vulnerability requires access to the NSIP management interface.
Frequently Asked Questions
Is CVE-2020-8193 being actively exploited?
Yes, CVE-2020-8193 is actively exploited in the wild. Public exploits exist and the vulnerability is commonly used in exploit chains alongside CVE-2020-8195 and CVE-2020-8196. The EPSS score of 0.94105 (99.91st percentile) confirms extremely high exploitation activity.
What products are affected by CVE-2020-8193?
Citrix ADC firmware versions 10.5 through 13.0, Citrix NetScaler Gateway firmware versions 10.5 through 12.1, Citrix Gateway firmware 13.0, and Citrix SD-WAN WANOP versions 10.2 through 11.1 are affected. These are enterprise network infrastructure appliances used for load balancing, VPN access, and application delivery.
How do I fix CVE-2020-8193?
Apply the fixed firmware versions specified in Citrix support article CTX276688. Restrict access to the NetScaler IP (NSIP) management interface to trusted management networks only. Also address related vulnerabilities CVE-2020-8195 and CVE-2020-8196 from the same advisory.
How severe is CVE-2020-8193?
CVE-2020-8193 is rated MEDIUM with a CVSS 3.1 score of 6.5. Despite the medium severity rating, the EPSS score of 0.94105 (99.91st percentile) indicates extremely high real-world exploitation. The vulnerability is commonly chained with other Citrix flaws for greater impact against critical network infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.