Thousands of companies could be at risk from an actively exploited Citrix zero-day that hackers have already abused to target at least one critical infrastructure organization in the United States.

Citrix last week sounded the alarm about the critical-rated flaw, tracked as CVE-2023-3519 with a severity rating of 9.8 out of 10, which impacts NetScaler ADC and NetScaler Gateway devices. These enterprise-facing products are designed for secure application delivery and providing VPN connectivity, and are used extensively worldwide, particularly within critical infrastructure organizations.

Citrix warned that the zero-day could allow an unauthenticated, remote attacker to run arbitrary code on a device and said it has evidence that the vulnerability was exploited in the wild. Citrix released security updates to the vulnerability on July 18 and is urging customers to install the patches as soon as possible.

Days after Citrix’s warning, U.S. cybersecurity agency CISA revealed that the vulnerability had been exploited against a U.S. critical infrastructure organization in June, and was reported to the agency earlier in July.

CISA said that hackers exploited the flaw to drop a webshell on the organization’s NetScaler ADC appliance, enabling them to collect and exfiltrate data from the organization’s Active Directory, including information about users, groups, applications and devices on the network. But because the targeted appliance was isolated within the organization’s network, the hackers were unable to move laterally and compromise the domain controller.

While this organization successfully managed to ward off the hackers targeting its systems, thousands of other organizations could be at risk. The Shadowserver Foundation, a nonprofit organization that works to make the internet more secure, said it has found more than 15,000 Citrix servers worldwide at risk of compromise unless patches are applied.

The largest number of unpatched servers are based in the U.S. (5,700), followed by Germany (1,500), the U.K. (1,000) and Australia (582), according to their analysis.

It’s not yet known who is behind the exploitation of this vulnerability, but Citrix vulnerabilities have been known to be exploited by both financially motivated cybercriminals and state-sponsored threat actors, including groups linked to China.

In a blog post published over the weekend, researchers at Mandiant said that while they cannot yet attribute the intrusions to any known threat group, the activity is “consistent with previous operations by China-nexus actors based on known capabilities and actions against Citrix ADC’s in 2022.” Mandiant added that the intrusions are likely part of an intelligence-gathering campaign, noting that espionage-motivated threat actors continue to target technologies that do not support endpoint detection and response solutions, such as firewalls, IoT devices, hypervisors and VPNs.

“Mandiant has investigated dozens of intrusions at defense industrial base (DIB), government, technology, and telecommunications organizations over the years where suspected China-nexus groups have exploited zero-day vulnerabilities and deployed custom malware to steal user credentials and maintain long-term access to the victim environments,” the researchers said.

Ryan Menezes is a professional writer and blogger. He has a Bachelor of Science in journalism from Boston University and has written for the American Civil Liberties Union, the marketing firm InSegment and the project management service Assembla. He is also a member of Mensa and the American Parliamentary Debate Association.

A zero-day vulnerability in Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway appears to be being exploited by an unspecified advanced persistent threat (APT) actor backed by the Chinese government and should be patched immediately.

Per Citrix’s initial advisory released on Tuesday 18 July, the three vulnerabilities patched by Citrix affect multiple versions of the NetScaler ADC (previously Citrix ADC) and NetScaler Gateway (previously Citrix Gateway) lines.

They are tracked as CVE-2023-3466, a reflected cross-site scripting flaw; CVE-2023-3467, a privilege escalation vulnerability; and CVE-2023-3519, an unauthenticated remote code execution (RCE) bug.

Of these, the issue of concern is the RCE vulnerability, CVE-2023-3519, which carries a CVSS score of 9.8, and it is this bug that was added to the US Cybersecurity and Infrastructure Security Agency’s (CISA’s) Known Exploited Vulnerabilities (KEV) list on 20 July.

The addition of a vulnerability to the KEV list mandates that US government bodies must address it by a set date. It carries no weight beyond this, but inclusion on this list is a sure sign that attention should be paid by all organisations.

According to the CISA, the threat actor exploited CVE-2023-3519 to drop a webshell on a non-production environment NetScaler ADC appliance owned by an operator of critical national infrastructure (CNI).

The RCE vulnerability, CVE-2023-3519, carries a CVSS score of 9.8 and was added to the US CISA’s Known Exploited Vulnerabilities list on 20 July. Inclusion on this list is a sure sign that attention should be paid by all organisations

Using this webshell, the actor then attempted to perform discovery actions on the victim’s active directory (AD) and exfiltrate data from it. They then tried to move laterally to a domain controller, but were thwarted in this instance when the appliance’s network-segmentation controls kicked in.

In this instance, the victim organisation was able to swiftly identify the compromise and duly reported the incident to both CISA and Citrix.

Assessing the impact of CVE-2023-3519, researchers at Mandiant, which played a key role in the initial investigation, said that because ADC devices are predominantly used in the IT sector and form a vital component of enterprise cloud datacentres, when it comes to ensuring the optimal delivery of enterprise applications, they present a tempting target.

However, wrote the analyst team, comprising James Nugent, Foti Castelan, Doug Bienstock, Justin Moore and Josh Murchie, Chinese threat actors often target devices that sit at the edge of the network because they can be harder to monitor, and very often don’t support intrusion detection solutions.

“Mandiant cannot attribute this activity based on the evidence collected thus far,” the team wrote. “However, this type of activity is consistent with previous operations by China-nexus actors based on known capabilities and actions against Citrix ADCs in 2022.

“The evolution of the China-nexus cyber threat landscape has evolved to such an extent that its ecosystem mirrors more closely that of financial crime clusters, with connections and code overlap not necessarily offering the comprehensive picture.”

Beyond applying the patch, Mandiant is additionally recommending that if any affected appliances are found to have been exploited, they should be rebuilt immediately. This upgrade process will overwrite some, but not all, of the directories where threat actors may drop webshells.

Security teams may also wish to re-evaluate whether or not their ADC or Gateway appliances’ management ports need unrestricted internet access, and limit access to only necessary IP addresses, which would make post-exploitation activities harder going forward.

Based on some of the other tactics, techniques and procedures (TTPs) outlined in Mandiant’s write-up, the research team is also recommending that affected organisations rotate all secrets stored in the configuration file, and any private keys or certificates useable for transport layer security (TLS) connections.

They may also wish to harden susceptible accounts in the domain to protect against credential exposure and limit a threat actor’s ability to obtain credentials for lateral movement.

Formerly known as Xenmobile, Citrix Endpoint Manager is a unified device management system that provides a simplified platform for IT departments to monitor and administer hardware of all types.

With features beyond the scope of standard Mobile Device Management (MDM) products, Citrix Endpoint Manager supports all commercially available mobile operating systems and desktop OSs. Offered stand-alone or as part of a more comprehensive selection of Citrix business software, Citrix Endpoint Manager aims to be seamless for the end user and effortless for the IT department to manage. 

Features