CVE-2019-19781.nse

description = [[
Detecta CITRIX Application Delivery Controller (ADC) potencialmente vulnerables a CVE-2019-19781 
]]

local http = require "http"
local shortport = require "shortport"
local vulns = require "vulns"
local stdnse = require "stdnse"
local string = require "string"

---
-- @hackyseguridad
-- nmap -Pn -sVC -p <port> --script CVE-2019-19781.nse <target>
--

author = "hackingyseguridad.com"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = { "vuln" }

portrule = shortport.http

action = function(host, port)
  local vuln = {
    title = "Detecta Citrix Application Delivery Controller (ADC) potencialmente vulnerable a CVE-2019-19781",
    state = vulns.STATE.NOT_VULN,
    description = [[
    ]],
    IDS = {
        CVE = "CVE-2019-19781"
    },
    references = {
        'https://support.citrix.com/article/CTX267027',
    },
    dates = {
        disclosure = { year = '2019', month = '12', day = '17' }
    }
  }

   -- Send a simple GET request to the server, if it returns appropiate string, then you have a vuln host
 options = {header={}}    options['header']['User-Agent'] = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
 --local req = http.get(host, port, uri, options)
 local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
 local url = stdnse.get_script_args(SCRIPT_NAME..".url") or "/logon/LogonPoint/tmindex.html"
 local response = http.generic_request(host, port, "GET", "/logon/LogonPoint/tmindex.html", options)

 if response.status == 200 then
 -- if response.status == 200 then
 vuln.state = vulns.STATE.VULN
 end

 return vuln_report:make_output(vuln)
end