CISA Adds Citrix ShareFile Flaw to KEV Catalog Due to In-the
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-24489 | Unauthenticated RCE in Citrix ShareFile Storage Zones Controller (CVE-2023-24489) CVE-2023-24489 is an improper access control flaw (CWE-284), rated critical at CVSS 9.8, in the customer-managed Citrix Content Collaboration ShareFile storage zones controller. It can be triggered remotely over the network by an unauthenticated attacker with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N). A successful attack allows the attacker to remotely compromise the customer-managed storage zones controller — described in vendor-adjacent coverage as remote code execution — giving control of the server that stores and syncs that organization's ShareFile files. Only organizations that self-host customer-managed storage zones controllers are affected; the vendor-managed (cloud) ShareFile service is not listed as affected. The flaw is being actively exploited in the wild: CISA added it to the KEV catalog on 2023-08-16, EPSS assigns a 97.3% probability of exploitation within 30 days (100th percentile), and the vendor urged customers to shut down or take unpatched controllers offline; ransomware use is not yet confirmed. Do: Apply the fix specified in the Citrix/ShareFile security bulletin by upgrading every customer-managed storage zones controller to the vendor's patched release, and follow vendor guidance to shut down or take offline any controller that cannot be patched immediately. Check whether controllers are internet-exposed and hunt for signs of compromise (unexpected files, processes, or webshells on storage zones), since the flaw is in the KEV catalog and ransomware use has not been ruled out. | 9.8 | 97% | KEV |
| moderate≈ thousands of internet-exposed customer-managed storage zone controllers (order-of-magnitude estimate) | |
| CVE-2023-3519 | Unauthenticated RCE in Citrix NetScaler ADC and NetScaler Gateway CVE-2023-3519 is a critical (CVSS 9.8) unauthenticated remote code execution flaw caused by improper code-injection handling (CWE-94) in Citrix NetScaler ADC and NetScaler Gateway. A remote attacker with no credentials can trigger it by sending crafted requests to an appliance configured as a Gateway (VPN/ICA proxy/RDP proxy) or AAA authentication virtual server, gaining arbitrary code execution on the appliance. Exploitation typically yields a foothold behind the VPN edge — access to internal networks, credential theft, and follow-on activity such as espionage or ransomware deployment. Any organization running unpatched NetScaler ADC/Gateway appliances, especially internet-facing remote-access endpoints, is affected; NetScaler is one of the most widely deployed enterprise VPN/ADC platforms. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-07-19 with known ransomware use, EPSS estimates a 99.7% exploitation probability, and researchers have linked activity to China-nexus espionage (Silk Typhoon) and ransomware operations. Do: Immediately upgrade internet-facing NetScaler ADC/Gateway appliances to the fixed builds in Citrix's advisory (14.1-8.50+, 13.1-49.13+, 13.0-82.45+, 12.1-55.300+, including FIPS/NDcPP equivalents) — per CISA KEV, apply these mitigations or discontinue use if patching is unavailable. Confirm whether each appliance is configured as a Gateway or AAA virtual server (only those are affected), and hunt for compromise — unexpected configuration changes, unfamiliar accounts, webshells, or anomalous VPN sessions — rotating credentials on any suspected compromise. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed NetScaler Gateway/ADC appliances (order 10k-100k at disclosure), serving hundreds of thousands to millions of downstream… |
Full article511 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 17, 2023Vulnerability / Enterprise Security
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security flaw in Citrix ShareFile storage zones controller to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active in-the-wild exploitation.
Tracked as CVE-2023-24489 (CVSS score: 9.8), the shortcoming has been described as an improper access control bug that, if successfully exploited, could allow an unauthenticated attacker to compromise vulnerable instances remotely.
The problem is rooted in ShareFile's handling of cryptographic operations, enabling adversaries to upload arbitrary files, resulting in remote code execution.
"This vulnerability affects all currently supported versions of customer-managed ShareFile storage zones controller before version 5.11.24," Citrix said in an advisory released in June. Dylan Pindur of Assetnote has been credited with discovering and reporting the issue.
It's worth noting that the first signs of exploitation of the vulnerability emerged toward the end of July 2023.
The identity of the threat actors behind the attacks is unknown, although the Cl0p ransomware gang has taken a particular interest in taking advantage of zero-days in managed file transfer solutions such as Accellion FTA, SolarWinds Serv-U, GoAnywhere MFT, and Progress MOVEit Transfer in recent years.
Threat intelligence firm GreyNoise said it observed a significant spike in exploitation attempts targeting the flaw, with as many as 75 unique IP addresses recorded on August 15, 2023, alone.
"CVE-2023-24489 is a cryptographic bug in Citrix ShareFile's Storage Zones Controller, a .NET web application running under IIS," GreyNoise said.
"The application uses AES encryption with CBC mode and PKCS7 padding but does not correctly validate decrypted data. This oversight allows attackers to generate valid padding and execute their attack, leading to unauthenticated arbitrary file upload and remote code execution."
Federal Civilian Executive Branch (FCEB) agencies have been mandated to apply vendor-provided fixes to remediate the vulnerability by September 6, 2023.
The development comes as security alarms have been raised about active exploitation of CVE-2023-3519, a critical vulnerability affecting Citrix's NetScaler product, to deploy PHP web shells on compromised appliances and gain persistent access.
Update
Citrix told The Hacker News that a fix for CVE-2023-24489 was released on May 11, 2023, with Version 5.11.24, a month before the security advisory was released on June 13, 2023.
"Customer patching was proactively handled and, by June 13, over 83% of these customers had patched their environments, before the incident was made public," a spokesperson for the company said. "Also, by June 13, all unpatched SZC hosts were blocked from connecting to the ShareFile cloud control plane, making unpatched SZC hosts unusable with ShareFile."
It also emphasized that the incident affected less than 3% of its install base (2,800 customers), that there was no data theft observed, and that the surge in attacks has since "died down."
(The story has been updated after publication to include a response from Citrix and to clarify that the issue was addressed in May 2023.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/08/cisa-adds-citrix-sharefile-flaw-to-kev.html