https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# citrix-netscaler
s
This message was deleted.
r
I am actually doing the same thing right now as we type.
n
When I try hitting the URL like "_https://$TARGET/vpn/../vpns/"_ I dont get any policy hits
c
Haven’t looked at the CU script, but is it maybe trying to look for the policy by name?
r
I get this before applying it
NOTE: this Script Action does not perform the suggested mitigation for the management interfaces (nsapimgr) as it may break administration access. Check https://support.citrix.com/article/CTX267679 for further details. * Step 1: Check for an existing mitigation responder policy: SUCCESS WARNING: => CVE-2019-19781 Mitigation Responder Policy NOT found. * Step 2: Check for responder policy global binding: SKIPPED (no policy found) This Citrix NetScaler ADC is vulnerable.
hmm same thing
c
For what it’s worth that warning about admin access breaking is probably for old versions of code, I’ve yet to have a customer tell me it’s broken anything in that arena.
n
@CTXMike I'm looking at the script now, it's quite long, but in the section that it creates the responder policy and actions for you, the names all match including case that the CTX article specifies for the commands. It looks like it's not looking for a specific policy name, but an expression containing the relevant http.req.url
r
how else can we ensure its in place?
well in place correctly?
c
can you link me to the CU script?
haven't messed much with the api but those double quoted strings look kinda weird.
n
c
you can use this info to test - bad response is 404 or 400, good response is 403
curl -k -X POST “https://<NSIP>/vpns/” -v --path-as-is -H “NSC_NONCE: test” -H “NSC_USER: test” -H “Cookie: NSC_AAAC=test” curl -k -X POST “https://<GW_VIP>/vpn/../vpns/” -v --path-as-is -H “NSC_NONCE: test” -H “NSC_USER: test” -H “Cookie: NSC_AAAC=test” curl -k -X POST “https://<AAA_VIP>/vpn/../vpns/” -v --path-as-is -H “NSC_NONCE: test” -H “NSC_USER: test” -H “Cookie: NSC_AAAC=test”
can test from ns shell as long as management can route to the addresses, or anything else with curl available
n
Thanks Mike
r
Thank you Mike
r
Are the headers necessary? In my testing I was still getting 200 just with 
https://<GW_VIP>/vpn/../vpns/
but I was only testing GW
e
The ControlUp script uses double quotes as it needs to escape the quotes in the PowerShell string. And it searches for any policy with the expression (exactly). I have updated the filter to use a -like instead of -eq to loosen the search. But did not run into any errors during testing. So curious to find why the script is not working for you. Could it be an older Citrix ADC firmware version (and different NITRO commands?)
r
Its worked on 11.1.5x prod. Just not my dev ones same version.
Not concerned as i know its mitigated
e
Thanks @Ray Davis for letting me know, just curious what is causing it as I did not run into it while testing the script (and I did put some hours into it 🤓). Just did not wanted to hear 'the baby is ugly' 😉
n
@Esther Barthel that was not my intention, I assumed it was just something I was doing wrong and wanted to try another method for verification, that's all.
r
@Esther Barthel no way. This was very awesome and i apologize if it came off that way. I very much appreciate it and it give me a piecw of mind.
e
Just the perfectionist in me that was already bumped I could not configure the shell command through NITRO. No worries guys, you did not hurt my feelings. Just an opportunity to learn to code even better the next time 😊
Open in Slack
PreviousNext
Powered by