Citrix ADC and Gateway Exploit - CVE-2019-19781

Several Citrix products contain a vulnerability that enables an attacker to traverse restricted directory paths and remotely run arbitrary code on the device. First, the attacker scans the target to confirm the presence of the vulnerability. Next, the attacker submits a POST request to upload a malicious script to the following path: https://../vpn/../vpns/ (1). Finally, the attacker sends a GET request to call the malicious URL (2) and run the script. Alternatively, the attacker can set up the script to run later or repeatedly as a cron job.