New exploits expose critical zero day flaw in Citrix ADC and gateway

Citrix urges clients to repair crucial vulnerability in NetScaler ADC and NetScaler Gateway

Citrix not too long ago issued an alert to its clients a couple of critical-severity vulnerability recognized as CVE-2023-3519 in its NetScaler ADC and NetScaler Gateway merchandise. The corporate strongly advises its clients to put in the up to date model immediately, as exploits for this vulnerability are already getting used within the wild.

zero-day vulnerability

It’s attainable that the safety concern being talked about is similar concern that was publicized as a zero-day vulnerability on a hacker dialogue board earlier this month. Nonetheless, the main points supplied about this vulnerability have been restricted, making it troublesome to definitively hyperlink it to the Citrix safety bulletin.

patches wanted for vulnerabilities

Citrix has launched new variations of its NetScaler ADC and Citrix Gateway merchandise to deal with a set of three vulnerabilities. Of the three, CVE-2023-3519 is probably the most severe, scoring 9.8 out of 10. This vulnerability permits attackers to remotely execute code with out authentication. To benefit from this safety flaw, a weak machine have to be configured as a gateway or digital authentication server.

Citrix has noticed vulnerabilities to CVE-2023-3519 on unsupported gadgets and strongly advises clients to replace to the next variations:

• Netscaler ADC and Netscaler Gateway 13.1–49.13 and later releases
• Netscaler ADC and Netscaler Gateway 13.0-91.13 and later releases of 13.0
• Netscaler ADC 13.1-FIPS 13.1-37.159 and later releases of 13.1-FIPS
• Netscaler ADC 12.1-FIPS 12.1-65.36 and later releases of 12.1-FIPS
• Netscaler ADC 12.1-ndcpp 12.1-65.36 and later releases of 12.1-ndcpp

Citrix emphasizes that clients utilizing NetScaler ADC and NetScaler Gateway Mannequin 12.1 ought to improve to a extra trendy model, as Mannequin 12.1 has reached its end-of-life part.

Zero-day advert on hacker dialogue board

In early July, an individual marketed a zero-day vulnerability for Citrix ADC on a hacker dialogue board. Though restricted particulars can be found, the timing and information within the commercial are in line with Citrix safety bulletins. The producer claims zero-day distant code execution that works for variations of Citrix ADC as much as 13.1 construct 48.47.

As well as, BleepingComputer obtained a tip indicating that Citrix was conscious of the zero-day advert on a cybercrime discussion board and was actively engaged on a patch to deal with the issue.

It’s anticipated that energetic operations could proceed till the restore is launched by Citrix. Organizations can take a look at for indicators of compromise by discovering Web shells created after the final arrange date and reviewing the HTTP error log for any discrepancies. As well as, administrators ought to test the shell log for any uncommon directions used within the subsequent part of the exploit.

XSS and privilege escalation vulnerabilities

The updates launched by Citrix additionally deal with two different vulnerabilities, recognized as CVE-2023-3466 and CVE-2023-3467. Each vulnerabilities have a Excessive severity ranking, with CVE-2023-3466 being a reflective cross-site scripting (XSS) concern and CVE-2023-3467 permitting an attacker to raise root administrator privileges.

CVE-2023-3466 could be exploited if a sufferer downloads a hyperlink from an attacker in a browser whereas the weak machine is accessible from the identical community. Alternatively, exploiting CVE-2023-3467 requires authenticated entry to the IP deal with or subnet IP of the Netscaler gadgets with entry to the administration interface.

On the time of writing, detailed technical particulars about all three vulnerabilities weren’t publicly out there. Nonetheless, organizations utilizing Netscaler ADC and gateway gadgets ought to make it a precedence to replace their programs to guard in opposition to potential exploits.

common query

1. What’s the vulnerability recognized as CVE-2023-3519?

Vulnerability CVE-2023-3519 is a critical-severity vulnerability current in Citrix’s NetScaler ADC and NetScaler Gateway merchandise. Attackers can exploit this vulnerability to remotely execute code with out authentication.

2. Are there any identified exploits for CVE-2023-3519 at the moment?

Positive sufficient, CVE-2023-3519 exploits have already been seen within the wild. Consequently, Citrix strongly advises its clients to put in up to date variations of NetScaler ADC and NetScaler Gateway to mitigate this vulnerability.

Though restricted particulars can be found, somebody marketed a zero-day vulnerability for Citrix ADC on a hacker discussion board in early July. Data supplied within the commercial conforms to the Citrix Safety Bulletin. The zero-day vulnerability permits distant code execution and is claimed to work for variations of Citrix ADC as much as 13.1 construct 48.47.

4. How can organizations take a look at that they’ve been compromised?

Organizations can test for attainable compromises by searching for new Web Shells from the final set up date and reviewing the HTTP error log for any inconsistencies. As well as, inspecting the shell log for uncommon directions utilized in a later part of the exploit can present extra perception into attainable compromises.

5. What different vulnerabilities have been addressed within the replace launched by Citrix?

Together with CVE-2023-3519, the updates additionally deal with two different vulnerabilities: CVE-2023-3466 and CVE-2023-3467. CVE-2023-3466 is a reflective cross-site scripting (XSS) vulnerability, whereas CVE-2023-3467 permits privilege escalation to the extent of root administrator.

conclusion

Citrix is ​​taking drastic measures to deal with crucial vulnerabilities in its NetScaler ADC and NetScaler Gateway merchandise. With the invention of CVE-2023-3519 already in use within the wild, Citrix urges its clients to replace their applied sciences to the most recent variations instantly. As well as, the corporate has launched updates to mitigate XSS and privilege escalation vulnerabilities. It will be significant for organizations utilizing Citrix NetScaler ADC and gateway gadgets to prioritize patching and keep safe from potential exploits.