HP ThinPro versions 7.1, 7.0, 6.2.1, and 6.2 suffer from a Citrix receiver connection wrapper command injection vulnerability.
301879be06768cb2bb289a3ce523bf8dHP ThinPro - Citrix command injection
===============================================================================
Identifiers
-------------------------------------------------
* CVE-2019-18909
CVSSv3 score
-------------------------------------------------
6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Vendor
-------------------------------------------------
HP - [https://www.hp.com](https://www.hp.com)
Product
-------------------------------------------------
Deliver secure desktop virtualization that’s as comfortable for IT as it is
for end users with the stunningly redesigned HP ThinPro. It has a bold new
user interface and workflow refinements that make it a breeze to configure,
manage, and use right out of the box.
Affected versions
-------------------------------------------------
- HP ThinPro Linux 7.1
- HP ThinPro Linux 7.0
- HP ThinPro Linux 6.2.1
- HP ThinPro Linux 6.2
Credit
-------------------------------------------------
Eldar Marcussen - xen1thLabs - Software Labs
Vulnerability summary
-------------------------------------------------
The Citrix receiver conection wrapper function does not safely handle user
supplied data allowing an unauthenticated attacker to use commandline
syntax to execute arbitrary commands on the device.
Technical details
------------------------------------------------
The user supplied values provided for the domain portion of the login
screens for `Citrix receiver` is vulnerable to command injection, an
unauthenticated attacker can exploit this to execute commands with the
privileges of the local user.
Proof of concept
-------------------------------------------------
The following evidence is provided to illustrate the existence and
exploitation:
1. At the `Citrix receiver` login screen enter the following details:
* username: \pwnt
* password: pwnt
* Domain should be empty
2. Click `Connect`
3. In the `Citrix server details` window, enter the following for domain:
`;xterm;echo `
4. Click `Connect`
5. Observe that xterm spawns
Solution
-------------------------------------------------
Contact vendor for a solution
Timeline
-------------------------------------------------
Date | Status
------------|-----------------------------
19-AUG-2019 | Reported to vendor
22-NOV-2019 | Patch available
24-MAR-2020 | Public disclosure