Citrix XenMobile Server CVE-2016-6877 Host Header Injection Vulnerability

Bugtraq ID:	98341
Class:	Input Validation Error
CVE:	CVE-2016-6877
Remote:	Yes
Local:	No
Published:	May 05 2017 12:00AM
Updated:	May 23 2017 04:23PM
Credit:	Michael Born and Will Caput
Vulnerable:	Citrix XenMobile Server 10.3.6.310
Not Vulnerable:	Citrix XenMobile Server 10.5.0.24

Citrix XenMobile Server CVE-2016-6877 Host Header Injection Vulnerability

Citrix XenMobile Server is prone to an host header-injection vulnerability because it fails to properly validate an HTTP request header.

A successful attack may allow attackers to insert a crafted host header to navigate the victim to the attacker's domain.

Citrix XenMobile Server 10.3.6.310 is vulnerable; other versions may also be affected.

Citrix XenMobile Server CVE-2016-6877 Host Header Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Citrix XenMobile Server CVE-2016-6877 Host Header Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Citrix XenMobile Server CVE-2016-6877 Host Header Injection Vulnerability

References:

• Citrix Homepage (Citrix)
  
• Citrix XenMobile Server HTTP Host Header Injection (solutionary.com)