CIS Logo
tagline: Confidence in the Connected World

Vulnerability in Citrix Application Delivery Controller (CVE-2019-19781) Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2020-002

DATE(S) ISSUED:

01/11/2020

OVERVIEW:

A vulnerability has been discovered in the Citrix Application Delivery Controller Web Server which could allow for remote code execution. Citrix Application Delivery Controller is a load balancer used for web, application, and database servers. Successful exploitation of this vulnerabilities could allow for arbitrary code execution within the context of a privileged process. Depending on the privileges associated with the web service, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

THREAT INTELLIGENCE:

January 11 - UPDATED THREAT INTELLIGENCE:
TrustedSec announced the availability of proof-of-concept exploit code for CVE-2019-19781 flaw in Citrix NetScaler ADC and Citrix NetScaler Gateway servers. The PoC is available on github (https://github.com/trustedsec/cve-2019-19781) and a forensic guide is available detailing how to check Citrix servers for evidence of a compromise (https://www.trustedsec.com/blog/netscaler-remote-code-execution-forensics/)

January 20 – UPDATED THREAT INTELLIGENCE:
Citrix releases fixed builds to address CVE-2019-19781 for Citrix ADC and Citrix Gateway versions 12.0 and 11.1. Additional fixed builds for vulnerable versions of Citrix ADC, Citrix Gateway, and Citrix SD-WAN WANOP are expected to be released on January 24th

***January 29 – UPDATED THREAT INTELLIGENCE:
Fireeye has reported that there has been cases of recent compromises which exploit this vulnerability to deploy coin miners. This activity suggests that the exploitation of this vulnerability may be used to deploy ransomware.


SYSTEMS AFFECTED:

  • Citrix ADC and Citrix Gateway version 13.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.1 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 11.1 all supported builds
  • Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds
  • Citrix SD-WAN WANOP appliance models 4000-WO, 4100-WO, 5000-WO, and 5100-WO all supported software release builds before 10.2.6b and 11.0.3b

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: HIGH
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: HIGH
Home Users:
MEDIUM

TECHNICAL SUMMARY:

A vulnerability has been discovered in the Citrix Application Delivery Controller Web Server which could allow for remote code execution. Successful exploitation of this vulnerability could allow for arbitrary code execution within the context of a privileged process. This vulnerability could be exploited by taking advantage of a directory traversal vulnerability and a vulnerability existing in the /vpns/ directory of the web server. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Apply the workaround provided by the Citrix advisory as there is currently no patch for this vulnerability
  • Apply appropriate patches provided by Citrix to vulnerable systems once available after appropriate testing.
  • Remind users not to download, accept, or execute files from un-trusted or unknown sources.
  • Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.
  • Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

JANUARY 20 – UPDATED RECOMMENDATIONS:

  • Apply appropriate patches provided by Citrix for Citrix ADC and Citrix Gateway versions 12.0 and 11.1, after appropriate testing.
  • Apply the workaround provided by the Citrix advisory until fixes are released on January 24 for other vulnerable versions.
  • Remind users not to download, accept, or execute files from un-trusted or unknown sources.
  • Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.
  • Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

***JANUARY 29 – UPDATED RECOMMENDATIONS:

  • If the mitigations were not previously applied in mid-December, it is currently recommended to wipe box/appliance clean before applying patches as many devices cannot be totally cleaned by tools provided by FireEye and Citrix.
  • Apply appropriate patches provided by Citrix for all vulnerable versions, after appropriate testing.
  • Remind users not to download, accept, or execute files from un-trusted or unknown sources.
  • Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.
  • Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

REFERENCES:

Carnegie Mellon University:
https://www.kb.cert.org/vuls/id/619785/

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Related Resources



Arrow CIS Control 3: Continuous Vulnerability Assessment and Remediation

Information Hub : Advisories


CONTROL: 1 --- ADVISORY CONTROL: 0
CONTROL: 2 --- ADVISORY CONTROL: 0
CONTROL: 3 --- ADVISORY CONTROL: 0
CONTROL: 4 --- ADVISORY CONTROL: 0

Pencil White paper 26 Oct 2020