Critical Citrix NetScaler Flaw Exploited to Target from Government, Tech Firms
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-4966 | Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway Citrix NetScaler ADC and NetScaler Gateway appliances contain a buffer overflow (CWE-119) that leaks sensitive information from device memory when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. A remote attacker who can reach such a configuration can trigger the overflow and read memory contents, harvesting sensitive data such as session tokens (a technique that enables session hijacking which can bypass multi-factor authentication). Any organization running an affected NetScaler ADC or Gateway appliance in these configurations is exposed, with appliances deployed as VPN or access gateways being the primary concern. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2023-10-18 with known ransomware use and a 100% EPSS exploitation probability, although no public proof-of-concept is known at this time. Because tokens stolen from memory can remain valid even after patching, responders must terminate all active and persistent sessions as part of remediation. Do: Upgrade affected appliances to the patched builds cited in Citrix's advisory, then immediately kill all active and persistent ICA/AAA sessions per the vendor instructions, since patching alone does not invalidate session tokens attackers may have already stolen. If patching is not immediately possible, discontinue use of the affected Gateway/AAA configurations as CISA directs. Given known ransomware abuse, also hunt for signs of exploitation such as logins from unexpected sources, anomalous session reuse, or suspicious mailbox changes, and reset credentials for potentially exposed accounts. | 7.5 | 100% | KEV ransomware |
| masshundreds of thousands of internet-exposed NetScaler ADC/Gateway appliances (public internet scan counts), plus an unknown number of VPN-only or internal… |
Full article426 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 18, 2023Enterprise Security / Vulnerability
Citrix is warning of exploitation of a recently disclosed critical security flaw in NetScaler ADC and Gateway appliances that could result in exposure of sensitive information.
Tracked as CVE-2023-4966 (CVSS score: 9.4), the vulnerability impacts the following supported versions -
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-8.50
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.15
- NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.19
- NetScaler ADC and NetScaler Gateway 12.1 (currently end-of-life)
- NetScaler ADC 13.1-FIPS before 13.1-37.164
- NetScaler ADC 12.1-FIPS before 12.1-55.300, and
- NetScaler ADC 12.1-NDcPP before 12.1-55.300
However, for exploitation to occur, it requires the device to be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or authorization and accounting (AAA) virtual server.
While patches for the flaw were released on October 10, 2023, Citrix has now revised the advisory to note that "exploits of CVE-2023-4966 on unmitigated appliances have been observed."
Google-owned Mandiant, in its own alert published Tuesday, said it identified zero-day exploitation of the vulnerability in the wild beginning in late August 2023.
"Successful exploitation could result in the ability to hijack existing authenticated sessions, therefore bypassing multi-factor authentication or other strong authentication requirements," the threat intelligence firm said.
"These sessions may persist after the update to mitigate CVE-2023-4966 has been deployed."
Mandiant also said it detected session hijacking where session data was stolen before the patch deployment, and subsequently used by an unspecified threat actor.
"The authenticated session hijacking could then result in further downstream access based upon the permissions and scope of access that the identity or session was permitted," it further added.
"A threat actor could utilize this method to harvest additional credentials, laterally pivot, and gain access to additional resources within an environment."
The threat actor behind the attacks has not been determined, but the campaign is said to have targeted professional services, technology, and government organizations.
In light of active abuse of the flaw and with Citrix bugs becoming a lightning rod for threat actors, it's imperative that users move quickly to update their instances to the latest version to mitigate potential threats.
"Organizations need to do more than just apply the patch – they should also terminate all active sessions," Mandiant CTO Charles Carmakal said. "Although this is not a remote code execution vulnerability, please prioritize the deployment of this patch given the active exploitation and vulnerability criticality."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/10/critical-citrix-netscaler-flaw.html