The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a recently discovered vulnerability in the Citrix Application Delivery Controller and Citrix Gateway web server appliances.
Exploitation of the vulnerability – tracked as CVE-2019-19781 – is possible over the internet and can allow remote execution of arbitrary code on vulnerable appliances. Exploitation of the flaw would allow a threat actor to gain access to the appliances and attack other resources connected to the internal network. Some security researchers have described the bug as one of the most dangerous to be discovered in recent years.
The alert, issued on January 8, 2019, urges all organizations using the affected Citrix appliances (formerly NetScaler ADC and NetScaler Gateway) to apply mitigations immediately to limit the potential for an attack, and to apply the firmware updates as soon as they are released later this month.
Two proof of concept exploits have already been published on GitHub which makes exploitation of the flaws trivial. Scans for vulnerable systems have increased since the publication of the exploits on Friday by Project Zero India and TrustedSec and attacks on honeypots setup by security researchers have increased in frequency over the weekend.
Worldwide there are approximately 80,000 companies in 158 countries that need to apply mitigations to correct the vulnerabilities. Approximately 38% of vulnerable organizations are located in the United States.
The flaws are present in all supported versions of the Citrix Application Delivery Controller and Citrix Gateway web server – versions 13.0, 12.1, 12.0, 11.1, and 10.5 – which include Citrix NetScaler ADC and NetScaler Gateway.
The path traversal bug was discovered by UK security researcher Mikhail Klyuchnikov who reported it to Citrix. The flaw can be exploited over the internet on a vulnerable appliance without the need for authentication. All that is required to exploit the flaw is to find a vulnerable appliance and send a specially crafted request along with the exploit code. The bug is being referred to as Shitrix by security researchers on cybersecurity forums.
Currently there is no patch available to correct the flaw. Citrix will be issuing a firmware upgrade later this month to correct the vulnerability, which is currently scheduled for release on January 20, 2020 for firmware versions 11.1 and 12.0, January 27, 2020 for versions 12.1 and 13.0, and January 31, 2020 for version 10.5.
In the meantime, it is essential for configuration changes to be applied to make it harder for the vulnerability to be exploited. These can be found on Citrix Support Page CTX267679.
Since the flaw is currently under active attack, after applying mitigations it is important to check to make sure the flaw has not already been exploited.
TrustedSec, which held back on publishing its PoC exploit code until an exploit had already been released on GitHub, has developed a tool that can be used to identify vulnerable Citrix instances on networks and has published potential indicators of compromised Citrix hosts.
The post DHS Warns of Critical Citrix Vulnerability Being Exploited in the Wild appeared first on HIPAA Journal.