Citrix ADC - Arbitrary File Read (CVE-2020-8193, CVE-2020-8195, CVE-2020-8196) (CVE-2020-8193, CVE-2020-8195, CVE-2020-8196)

Citrix ADC, Citrix Gateway, Netscaler Gateway and Citrix SDWAN WAN-OP are affected by an Arbitrary File Read vulnerability, through an authorization bypass. The root cause of this vulnerability is that the server did not properly restrict access to the vulnerable exposed endpoint. An attacker can send crafted requests to the NSIP address to bypass the administration login. This can lead to information disclosure vulnerabilities (CVE-2020-8195, CVE-2020-8196), where an attacker can view sensitive files, including configuration files.

The risk exists that a remote unauthenticated attacker can read any file on the server in order to steal confidential information.

Sniper can read arbitrary files from the target system and extract them as evidence.

Apply the latest patch, which fixes this vulnerability.

https://nvd.nist.gov/vuln/detail/CVE-2020-8193

https://nvd.nist.gov/vuln/detail/CVE-2020-8195

https://nvd.nist.gov/vuln/detail/CVE-2020-8196