Citrix - SQLi (CVE-2019-12989)

CVE-2019-12989 is a critical vulnerability in Citrix SD-WAN that allows remote attackers to perform SQL injection through a specific configuration endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

CrowdSec network data shows that most actors exploiting CVE-2019-12989 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2019-12989 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2019-12989 is currently experiencing high visibility and active exploitation across the internet.

Exploitation attempts are associated with requests targeting URLs containing /sdwan/nitro/v1/config/get_package_file and an associated file download action.