===============================================================================
Identifiers
-------------------------------------------------
* CVE-2019-18909
CVSSv3 score
-------------------------------------------------
6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Vendor
-------------------------------------------------
HP - [https://www.hp.com](https://www.hp.com)
Product
-------------------------------------------------
Deliver secure desktop virtualization that’s as comfortable for IT
as it is
for end users with the stunningly redesigned HP ThinPro. It has a
bold new
user interface and workflow refinements that make it a breeze to
configure,
manage, and use right out of the box.
Affected versions
-------------------------------------------------
- HP ThinPro Linux 7.1
- HP ThinPro Linux 7.0
- HP ThinPro Linux 6.2.1
- HP ThinPro Linux 6.2
Credit
-------------------------------------------------
Eldar Marcussen - xen1thLabs - Software Labs
Vulnerability summary
-------------------------------------------------
The Citrix receiver conection wrapper function does not safely
handle user
supplied data allowing an unauthenticated attacker to use
commandline
syntax to execute arbitrary commands on the device.
Technical details
------------------------------------------------
The user supplied values provided for the domain portion of the
login
screens for `Citrix receiver` is vulnerable to command injection,
an
unauthenticated attacker can exploit this to execute commands with
the
privileges of the local user.
Proof of concept
-------------------------------------------------
The following evidence is provided to illustrate the existence
and
exploitation:
1. At the `Citrix receiver` login screen enter the following
details:
* username: \pwnt
* password: pwnt
* Domain should be empty
2. Click `Connect`
3. In the `Citrix server details` window, enter the following for
domain:
`;xterm;echo `
4. Click `Connect`
5. Observe that xterm spawns
Solution
-------------------------------------------------
Contact vendor for a solution
Timeline
-------------------------------------------------
Date | Status
------------|-----------------------------
19-AUG-2019 | Reported to vendor
22-NOV-2019 | Patch available
24-MAR-2020 | Public disclosure