Following the release of exploit scripts for a critical flaw in Citrix Application Delivery Controller (ADC) and Gateway, attackers launch attacks against vulnerable hosts, while Citrix announces release date for patches UPDATE 01/24/2020: This blog post has been updated to reflect the availability of patches released by Citrix. Background Attacks Increase After Exploit Scripts Released

CVE-2019-19781: Critical Vulnerability in Citrix ADC and Gateway Sees Active Exploitation While Patches are Still Not Available

Attackers are actively probing for vulnerable Citrix Application Delivery Controller (ADC) and Gateway hosts, while multiple proof-of-concept scripts are released, emphasizing the importance of mitigating this flaw immediately.

CVE-2019-19781: Exploit Scripts for Remote Code Execution Vulnerability in Citrix ADC and Gateway Available

Citrix urges customers to apply mitigation steps for CVE-2019-19781, a remote code execution vulnerability exploitable through specially crafted HTTP requests to vulnerable devices.

CVE-2019-19781: Unauthenticated Remote Code Execution Vulnerability in Citrix ADCs and Gateways

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.

Iran-based Cyber Actors Targeting US Organizations Leveraging Vulnerabilities for Initial Access

The remote Citrix ADC or Citrix NetScaler Gateway device is affected by an arbitrary code execution vulnerability. An unauthenticated, remote attacker may be able to leverage this vulnerability to perform arbitrary code execution on an affected host.

Art Manion and Will Dormann report :

By using an older and less-secure form of open(), it is possible for untrusted template files to cause reads/writes outside of the template directories. This vulnerability is a component of the recent Citrix exploit.

The version of Citrix ADC or Citrix NetScaler Gateway SSL VPN running on the remote web server is affected by a path traversal vulnerability that can lead to remote code execution. An unauthenticated, remote attacker can exploit this issue, by sending a specially crafted HTTP request to perform a path traversal that can lead to acheiving remote code execution.

The remote Citrix ADC or Citrix NetScaler Gateway device is affected by an arbitrary code execution vulnerability.
An unauthenticated, remote attacker may be able to leverage this vulnerability to perform arbitrary code execution on an affected host.

Please refer to advisory CTX267027 for more information.

ID	Name	Product	Family	Type	Severity
701262	Citrix ADC and Citrix NetScaler Gateway Arbitrary Code Execution (CTX267027)	Nessus Network Monitor	SNMP		critical
132879	FreeBSD : Template::Toolkit -- Directory traversal on write (2bab995f-36d4-11ea-9dad-002590acae31)	Nessus	FreeBSD Local Security Checks	Local	critical
132752	Citrix ADC and Citrix NetScaler Gateway Arbitrary Code Execution (CTX267027) (Direct Check)	Nessus	CGI abuses	Remote	critical
132397	Citrix ADC and Citrix NetScaler Gateway Arbitrary Code Execution (CTX267027)	Nessus	CGI abuses	Combined	critical

Detections

Analytics

CVE-2019-19781

critical

Tenable Plugins

critical

critical

critical

critical