Citrix - SQLi (CVE-2019-12989)

CVE-2019-12989 is a critical vulnerability in Citrix SD-WAN that allows remote attackers to perform SQL injection through a specific configuration endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

CrowdSec network data shows that most actors exploiting CVE-2019-12989 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2019-12989 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Exploitation attempts are associated with requests targeting URLs containing /sdwan/nitro/v1/config/get_package_file and an associated file download action.