Are Citrix Netscalers vulnerable to shellshock bash command?

Question

My enterprise environment is "protected" with reverse proxies, how safe am I?

Answer 1

Netscalers appear to be vulnerable!

Netscaler is running GNU bash, version 2.05b.0(1) , which is stated as vulnerable in http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271

Here is what I get:

root@ns# env x='() { :;}; echo vulnerable' bash -c "echo this is a test" vulnerable this is a test root@ns#

Response from Citrix on the ticket I raised:

" I would like to inform you that our security team is looking into this issue and this is under investigation, we are expecting an Update soon on this. "

while we wait for official fix release from Citrix you might have to use your IPS (in my case palo alto) signatures to deny such attacks for remote websites and keep watch/restrict management access on Netscaler .

Answer 2

Also note that there are two ways to mitigate this:

If you have the Web App Firewall feature on your NetScaler (Platinum Edition or Enterprise with the WAF license) we have a WAF Signature that can be downloaded from the website:

https://www.citrix.com/downloads/netscaler-adc/components/application-signature-protection-for-shellshock-vulnerability (Requires login.)

For those without the WAF feature, we have developed a Responder policy that can be enabled in all versions. The CLI cmds to enable this are:

enable ns feature responder

add audit messageaction ShellShock_Log CRITICAL "\"The request was sent from \" +CLIENT.IP.SRC + \" Bash Code Injection Vulnerability\"" -bypassSafetyCheck YES

add responder policy ShellShock_policy "HTTP.REQ.FULL_HEADER.REGEX_MATCH(re/\(\)\s*{/) || HTTP.Req.BODY(1000).REGEX_MATCH(re/\(\s*\)/) || HTTP.REQ.URL.QUERY.REGEX_MATCH(re/\(\)\s*{/) || HTTP.REQ.BODY(1000).REGEX_MATCH(re#%28%29[+]*%7B#)" DROP -logAction ShellShock_Log

bind responder global ShellShock_policy 10 END -type REQ_DEFAULT

save config

Answer 3

Here's the official statement...

http://support.citrix.com/article/CTX200217

Citrix NetScaler ADC and NetScaler Gateway We are not currently aware of any direct risk from this issue to the main traffic path for NetScaler vServer endpoints. Some risk may exist for management interfaces so, in line with existing best practice, we recommend that access to any NetScaler management interfaces are constrained to trusted users and networks only.

This guidance will be updated as our analysis continues.