Citrix NFuse Network Information Disclosure Vulnerability
BID:4142
Info
Citrix NFuse Network Information Disclosure Vulnerability
| Bugtraq ID: | 4142 |
| Class: | Design Error |
| CVE: |
CVE-2002-0301 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 20 2002 12:00AM |
| Updated: | Jul 11 2009 10:56AM |
| Credit: | Discovered by Bob Fiero <[email protected]>. |
| Vulnerable: |
Citrix Nfuse 1.6 |
| Not Vulnerable: | |
Discussion
Citrix NFuse Network Information Disclosure Vulnerability
Citrix NFuse is an application portal server meant to provide the functionality of any application on the server via a web browser. Nfuse works in conjunction with a previously-installed webserver.
An issue has been reported in NFuse which could allow a remote user to reveal network structure information of a host.
Reportedly, submitting a request while specifying the 'NFUSE_USER' and 'NFUSE_PASSWORD' parameters with arbitrary information, could reveal network structure information including server and domain names.
If this issue is successfully exploited, an attacker may use this information to assist in further attacks against the host.
Citrix NFuse is an application portal server meant to provide the functionality of any application on the server via a web browser. Nfuse works in conjunction with a previously-installed webserver.
An issue has been reported in NFuse which could allow a remote user to reveal network structure information of a host.
Reportedly, submitting a request while specifying the 'NFUSE_USER' and 'NFUSE_PASSWORD' parameters with arbitrary information, could reveal network structure information including server and domain names.
If this issue is successfully exploited, an attacker may use this information to assist in further attacks against the host.
Exploit / POC
Citrix NFuse Network Information Disclosure Vulnerability
No exploit code required.
No exploit code required.