【漏洞通告】Citrix ADC和Citrix Gateway远程代码执行漏洞（CVE-2022-27518）

Citrix ADC、Citrix Gateway、远程代码执行漏洞

攻击者利用此漏洞可实现远程代码执行

add authentication samlAction

add authentication samlIdPProfile

rule tricklancer_a {

 strings:

 $str1 = "//var//log//ns.log" nocase ascii wide

 $str2 = "//var//log//cron" nocase ascii wide

 $str3 = "//var//log//auth.log" nocase ascii wide

 $str4 = "//var//log//httpaccess-vpn.log" nocase ascii wide

 $str5 = "//var//log//nsvpn.log" nocase ascii wide

 $str6 = "TF:YYYYMMddhhmmss" nocase ascii wide

 $str7 = "//var//log//lastlog" nocase ascii wide

 $str8 = "clear_utmp" nocase ascii wide

 $str9 = "clear_text_http" nocase ascii wide

condition:

 7 of ($str*)

}

rule tricklancer_b {

 strings:

 $str1 = "nsppe" nocase ascii wide

 $str2 = "pb_policy -h nothing" nocase ascii wide

 $str3 = "pb_policy -d" nocase ascii wide

 $str4 = "findProcessListByName" nocase ascii wide

 $str5 = "restoreStateAndDetach" nocase ascii wide

 $str6 = "checktargetsig" nocase ascii wide

 $str7 = "DoInject" nocase ascii wide

 $str8 = "DoUnInject" nocase ascii wide

 condition:

 7 of ($str*)

}

rule tricklancer_c {

 strings:

 $str1 = "is_path_traversal_or_vpns_attack_request" nocase ascii wide

 $str2 = "ns_vpn_process_unauthenticated_request" nocase ascii wide

 $str3 = "mmapshell" nocase ascii wide

 $str4 = "DoUnInject" nocase ascii wide

 $str5 = "CalcDistanse" nocase ascii wide

 $str6 = "checkMyData" nocase ascii wide

 $str7 = "vpn_location_url_len" nocase ascii wide

condition:

 5 of ($str*)

 }