Collected research

SD-PWN Part 2 --- Citrix SD-WAN Center

SD-PWN Part 2 — Citrix SD-WAN Center — Another Network Takeover

Ariel Tempelhof · Medium · 15 November 2020

Citrix SD-WAN Center runs CakePHP2, whose URL parser drops everything before a scheme separator that precedes a question mark, so Apache and the framework disagree about the path and the client-certificate restriction on the collector endpoint is bypassed. Chained with an unsanitised path traversal into shell_exec, that yields pre-authentication remote code execution.

Record

Document

SD-PWN Part 2 — Citrix SD-WAN Center — Another Network Takeover

Researcher

Ariel Tempelhof

Published by

Medium

Date

15 November 2020

Topic

Other

In the archive

• Collected in the 2020 research round

Related sources

• Author exploitation script

Tags

• parser-differential
• rce
• auth-bypass
• command-injection
• path-traversal
• url-parsing
• php
• cve
• attack-chain
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Ariel Tempelhof, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.