Rename CVE-2025-6543.yaml to CVE-2025-6543.yaml

javascript/cves/2025/CVE-2025-6543.yaml

@@ -0,0 +1,67 @@
+id: CVE-2025-6543
+
+info:
+  name: Citrix NetScaler SNMP 
+  author: pussycat0x,ritikchaddha
+  severity: high
+  description: |
+    Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6543
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-6543
+    cwe-id: CWE-119
+    cpe: cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"NetScaler" OR product:"Citrix"
+  tags: cve,cve2025,network,snmp,citrix,netscaler,kev,vkev
+
+javascript:
+  - pre-condition: |
+      isUDPPortOpen(Host, Port);
+
+    code: |
+      const c = require("nuclei/net");
+      const conn = c.Open('udp', `${Host}:${Port}`, `${Timeout}`);
+      let community_string = bytes.NewBuffer();
+      community_string.WriteString(Community);
+      let communityHex = community_string.Hex();
+      let communityLen = Community.length.toString(16).padStart(2, '0');
+      let communityField = "04" + communityLen + communityHex;
+      
+      const version = "020101";
+      const requestId = "020400000001";
+      const errorStatus = "020100";
+      const errorIndex = "020100";
+      const oid = "06082b060102010101000500"; // sysDescr.0 OID
+      const varbindList = "300e300c" + oid;
+      const pduData = requestId + errorStatus + errorIndex + varbindList;
+      const pduLen = (pduData.length / 2).toString(16).padStart(2, '0');
+      const pdu = "a0" + pduLen + pduData;
+      const messageData = version + communityField + pdu;
+      const messageLen = (messageData.length / 2).toString(16).padStart(2, '0');
+      const payload = "30" + messageLen + messageData;
+      conn.SendHex(payload);
+      let resp = conn.RecvFullString(1024);
+      resp;
+
+    args:
+      Host: "{{Host}}"
+      Port: 161
+      Timeout: 3
+      Community: "{{community_string}}"
+
+    attack: clusterbomb
+
+    payloads:
+      community_string:
+        - public
+
+    extractors:
+      - type: dsl
+        dsl:
+          - response