CVE-2020-10112

Vulnerability

Citrix Gateway versions 11.1, 12.0, and 12.1 are reported to allow cache poisoning [1]. The vulnerability involves manipulation of cached content served under specific URL paths. Citrix disputes this as a vulnerability, stating that by default, Citrix ADC only caches static content under certain paths for Gateway usage, and no dynamic content is served there.

Exploitation

An attacker with network access could potentially poison the cache by sending crafted requests that cause the gateway to cache malicious content [1]. The exact prerequisites and steps are not fully detailed in the available reference.

Impact

Successful cache poisoning could lead to serving of malicious content to users, potentially resulting in information disclosure or further attacks [1]. However, Citrix argues that the cached content is static and not user-controllable, limiting impact.

Mitigation

Citrix has not released a patch as they dispute the vulnerability. Users are advised to review Citrix's guidance and consider restricting cacheable paths. No official fix is available [1].