关联漏洞
标题：
Citrix ADC 和 Citrix Gateway 代码注入漏洞
(CVE-2023-3519)
描述：Citrix Systems Citrix Gateway（Citrix Systems NetScaler Gateway）和Citrix ADC都是美国思杰系统（Citrix Systems）公司的产品。Citrix Gateway是一套安全的远程接入解决方案。该产品可为管理员提供应用级和数据级管控功能，以实现用户从任何地点远程访问应用和数据。Citrix ADC是一个最全面的应用程序交付和负载平衡解决方案。用于实现应用程序安全性、整体可见性和可用性。 Citrix ADC 和 Citrix Gate
描述
Script for checking CVE-2023-3519 for Backdoors
介绍
# cve-2023-3519-citrix-scanner
This script is a basic Citrix Scanner for CVE-2023-3519.
We try to identify vulnerable Citrix Gateways/ADCs by looking at the HTTP headers.
## How it works
During our analysis of this vulnerability, we and our friends at [CERT-Verbund](https://www.cert-verbund.de/) noticed, that our patched systems had the same HTTP header `Last-Modified` timestamp.
Note that reverse proxies and heavily customised front pages may alter the results.
In this case, we check, if the timestamp is volatile. It it isn't and the timestamp is newer than 18. July 2023, the server has probably been patched.
This script should not be your only method of checking that you are not vulnerable.
Our current known timestamps are:
| Patch | Last-Modified Timestamp |
| --- | --- |
| 13.1-49.13 | `Mon, 10 Jul 2023 17:41:17 GMT` |
| 13.1-49.13 | `Mon, 10 Jul 2023 18:36:14 GMT` |
| 13.0-91.13 | `Fri, 07 Jul 2023 15:39:40 GMT` |
## Usage
Clone the repository:
```bash
git clone https://github.com/telekom-security/cve-2023-3519-citrix-scanner
cd cve-2023-3519-citrix-scanner
```
Create a file called `targets.txt`, containing your targets line by line.
An example can be found in `targets.txt.example`.
Run the script.
## Further reading
Florian Roth has published a list of further resources for this vulnerability: [https://twitter.com/cyb3rops/status/1682297555424628736](https://twitter.com/cyb3rops/status/1682297555424628736)
文件快照
[4.0K] /data/pocs/fc7bcd5739ba3a302243b9889b14a8032ddde709
├── [2.7K] CVE-2023-3519-checker.py
├── [ 34K] LICENSE
├── [1.4K] README.md
├── [ 1] targets.txt
└── [ 45] targets.txt.example
0 directories, 5 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。