Man-in-the-Middle Vulnerability in Citrix XenMobile Server

CVE-2016-6877

Summary

Certain earlier versions of Citrix XenMobile Server expose a vulnerability that allows man-in-the-middle attackers to manipulate HTTP requests and trigger HTTP 302 redirections. This can be achieved through crafted HTTP Host headers and the use of cached pages, enabling attackers to redirect traffic intended for legitimate servers. Despite the vendor's assessment that exploitation requires a man-in-the-middle scenario against a TLS session, the implications of this vulnerability warrant careful consideration in configurations involving sensitive communications.

References