Alexander Constantinou

Unauthenticated XXE reads DB config → admin creds → Freemarker SSTI in report module → OS commands as SYSTEM. Two bugs, one pre-auth RCE chain.

Oversized TLS SNI extension overflows a 512-byte heap buffer → corrupts adjacent chunk header → function pointer overwrite → root. CVSS 9.8, zero-day exploitation by state actor.

Unauthenticated Redis → CONFIG SET dir to web root → PHP webshell as www-data → backup .env leaks SSH creds → world-writable sudo script → root.

Legacy /NmAPI/ endpoint missing auth → raw reportId in SQL query → xp_cmdshell via sysadmin service account → NT AUTHORITY\SYSTEM. CVSS 9.8.

Debug handler in nsmgmtd checks for X-Citrix-Debug header → bypasses all auth → full NITRO REST API access → root RCE.

Leaked LDAP credentials → password spray → WinRM foothold → ESC8 (AD CS HTTP enrollment) → PetitPotam + ntlmrelayx → PKINIT → DCSync.