Rule Document 1:67173

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Citrix NetScaler command injection attempt

Rule Explanation

An attacker who has the ability to reach the /doAuthentication.do page of a Citrix NetScaler device may exploit a pre-authentication command injection vulnerability located within that page. Attackers who are able to execute commands within specific parameters available within that page may execute code remotely on the host in the context of the system.

What To Look For

This rule alerts on attempts to exploit a pre-auth command injection in Citrix NetScaler devices.

Known Usage

Attacks/Scans seen in the wild

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group