Zero-Day Attacks Exploited Critical Vulnerability in Citrix ADC and Gateway

July 19, 2023THNMoreVulnerability / Cyber ​​Threat

Citrix is ​​warning users that its NetScaler Application Delivery Controller (ADC) and gateway have serious security flaws that are being exploited in the wild.

tracked CVE-2023-3519 (CVSS score: 9.8), this issue is related to code injection cases that can lead to unauthenticated remote code execution. Affects the following versions:

• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.13
• NetScaler ADC and NetScaler Gateway 13.0 before 13.0-91.13
• NetScaler ADC and NetScaler Gateway version 12.1 (now end of life)
• NetScaler ADC 13.1-FIPS prior to NetScaler ADC 13.1-37.159
• NetScaler ADC 12.1-FIPS prior to NetScaler ADC 12.1-55.297, and
• Before NetScaler ADC 12.1-NDcPP 12.1-55.297

The company did not provide further details about the flaws related to CVE-2023-3519, other than saying that it has seen exploitation of this flaw in “unmitigated appliances.” However, the device must be configured as a gateway (VPN virtual server, ICA proxy, CVPN, RDP proxy) or an authorization and accounting (AAA) virtual server for the exploit to succeed.

Alongside CVE-2023-3519, we are also addressing two other bugs.

• CVE-2023-3466 (CVSS Score: 8.3) – Improper input validation vulnerability allows reflected cross-site scripting (XSS) attacks.
• CVE-2023-3467 (CVSS Score: 8.0) – Improper privilege management vulnerability allows privilege escalation to root administrator (nsroot).

Wouter Rijkbost and Jorren Geurts of Resillion reported the bug. A patch has been released that addresses his three flaws in the version below.

• NetScaler ADC and NetScaler Gateway 13.1-49.13 and later releases
• NetScaler ADC and NetScaler Gateway 13.0-91.13 and 13.0 and later releases
• NetScaler ADC 13.1-FIPS 13.1-37.159 and later releases of 13.1-FIPS
• NetScaler ADC 12.1-FIPS 12.1-55.297 or later 12.1-FIPS releases, and
• NetScaler ADC 12.1-NDcPP 12.1-55.297 and later 12.1-NDcPP releases

NetScaler ADC and NetScaler Gateway version 12.1 customers are encouraged to upgrade their appliances to a supported version to mitigate potential threats.

This development comes amid active exploitation of security flaws found in Adobe ColdFusion (CVE-2023-29298 and CVE-2023-38203) and the WooCommerce Payments WordPress plugin (CVE-2023-28121). was broken.

Neglecting security flaws in WordPress plugins opens the door to full compromise, allowing attackers to reuse compromised WordPress sites for other malicious activities.

Last month, eSentire revealed an attack campaign called Nitrogen. In this campaign, a compromised WordPress site was used to host a malicious ISO image file that, when launched, could eventually connect to a remote server and retrieve an additional payload, including a Python script. A malicious DLL file is deployed. And Cobalt Strike.