Target Policy

Structured Scope

• Asset Identifier

  Asset Type

  Max Severity

• NetScaler ADC

  ---

  Critical

  Remote code execution, e.g., code execution on CC production, remote code execution with root level access on host machine or multi-tenant key compromise
  Service key compromise, e.g., taking over a multi-tenant key

  High

  Service key compromise, e.g., taking over a single tenant key
  SQL injection, e.g., cross-tenant data exfiltration
  IDOR/missing authorization checks leading to key compromise or customer data leakage
  Unrestricted XXE/file system access, e.g., cross-tenant data leak
  Directory traversal/arbitrary file read - depending on types of files that can be read, e.g., system file read issues

  Medium

  CSRF - excluding on logout and on publicly available forums
  XSS - depending on impact and type of XSS

  Low

  Other vulnerabilities with proven impact which are not listed as out of scope

  Out of Scope:

  Server misconfiguration leading to compromise or data leak
  Any vulnerabilities that are reported determined to be due to the configuration issue

  OTHER

  critical
• NetScaler AAA

  ---

  Critical

  Remote code execution, e.g., code execution on CC production, remote code execution with root level access on host machine or multi-tenant key compromise
  Service key compromise, e.g., taking over a multi-tenant key

  High

  Service key compromise, e.g., taking over a single tenant key
  SQL injection, e.g., cross-tenant data exfiltration
  IDOR/missing authorization checks leading to key compromise or customer data leakage
  Unrestricted XXE/file system access, e.g., cross-tenant data leak
  Directory traversal/arbitrary file read - depending on types of files that can be read, e.g., system file read issues

  Medium

  CSRF - excluding on logout and on publicly available forums
  XSS - depending on impact and type of XSS

  Low

  Other vulnerabilities with proven impact which are not listed as out of scope

  Out of Scope:

  Any vulnerabilities that are reported determined to be due to the configuration issue

  OTHER

  critical
• NetScaler

  ---

  Instructions:

  Treasury Map been attached for the researchers reference

  Critical

  Remote code execution, e.g., code execution on CC production, remote code execution with root level access on host machine or multi-tenant key compromise
  Service key compromise, e.g., taking over a multi-tenant key

  High

  Service key compromise, e.g., taking over a single tenant key
  SQL injection, e.g., cross-tenant data exfiltration
  IDOR/missing authorization checks leading to key compromise or customer data leakage
  Unrestricted XXE/file system access, e.g., cross-tenant data leak
  Directory traversal/arbitrary file read - depending on types of files that can be read, e.g., system file read issues

  Medium

  CSRF - excluding on logout and on publicly available forums
  XSS - depending on impact and type of XSS

  Low

  Other vulnerabilities with proven impact which are not listed as out of scope

  Out of Scope:

  Any vulnerabilities that are reported determined to be due to the configuration issue

  API

  critical
• NetScaler Gateway

  ---

  Critical

  Remote code execution, e.g., code execution on CC production, remote code execution with root level access on host machine or multi-tenant key compromise
  Service key compromise, e.g., taking over a multi-tenant key

  High

  Service key compromise, e.g., taking over a single tenant key
  SQL injection, e.g., cross-tenant data exfiltration
  IDOR/missing authorization checks leading to key compromise or customer data leakage
  Unrestricted XXE/file system access, e.g., cross-tenant data leak
  Directory traversal/arbitrary file read - depending on types of files that can be read, e.g., system file read issues

  Medium

  CSRF - excluding on logout and on publicly available forums
  XSS - depending on impact and type of XSS

  Low

  Other vulnerabilities with proven impact which are not listed as out of scope

  Out of Scope:

  Server misconfiguration leading to compromise or data leak
  Misconfigured S3 buckets - only when the attacker can weaponize the buckets/instance
  Any vulnerabilities that are reported determined to be due to the configuration issue

  OTHER

  critical

• Download wordlist

Last Finished Scan: