Exploits in the Wild for Citrix ADC and Citrix Gateway Directory Traversal Vulnerability CVE-2019
Unit 42 confirmed in-the-wild exploitation of CVE-2019-19781, a critical Citrix ADC/Gateway directory traversal flaw enabling unauthenticated file access and RCE.
CVE-2019-19781, a CVSS 9.8 directory traversal vulnerability, affects all supported versions of Citrix ADC and Citrix Gateway. Unit 42 captured multiple exploitation attempts in the wild and identified scanning activity from roughly 700 Shodan-exposed hosts. The flaw stems from improper pathname handling in Apache, allowing unauthenticated attackers to read sensitive files like smb.conf or achieve remote code execution via crafted XML. Palo Alto Networks released Threat Prevention signatures 57497 and 57570 on January 7, 2020, while Citrix published advisories CTX267027 and CTX267679 with responder policy mitigations pending a late-January patch.
- Directory traversal allows unauthenticated access to configuration files
- Crafted XML POST requests can lead to remote code execution
- Palo Alto released signatures 57497 and 57570 on January 7, 2020
- Citrix mitigation uses responder policy to block /vpns/ and /../ requests
- CVEs
- CVE-2019-19781
- Organizations
- Palo Alto NetworksUnit 42Shodan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-19781 | Unauthenticated path traversal RCE in Citrix ADC, Gateway, and SD-WAN WANOP | 9.8 | 100% | KEVRansomware | KEV |
From the original article
4 min read at unit42.paloaltonetworks.com
Just before the holidays, a vulnerability was identified in Citrix Application Delivery Controller (ADC) and Citrix Gateway which allowed remote attackers to easily send directory traversal requests, read sensitive information from system configuration files without the need for user authentication and remotely execute arbitrary code.
By Yue Guan, Qi Deng, Zhibin Zhang, Siddhart Shibiraj, John Harrison, Cecilia Hu · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.