CIS Logo
tagline: Confidence in the Connected World

Vulnerability in Citrix Application Delivery Controller (CVE-2019-19781) Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2020-002

DATE(S) ISSUED:

01/11/2020

OVERVIEW:

A vulnerability has been discovered in the Citrix Application Delivery Controller Web Server which could allow for remote code execution. Citrix Application Delivery Controller is a load balancer used for web, application, and database servers. Successful exploitation of this vulnerabilities could allow for arbitrary code execution within the context of a privileged process. Depending on the privileges associated with the web service, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

THREAT INTELLIGENCE:

January 11 - UPDATED THREAT INTELLIGENCE:
TrustedSec announced the availability of proof-of-concept exploit code for CVE-2019-19781 flaw in Citrix NetScaler ADC and Citrix NetScaler Gateway servers. The PoC is available on github (https://github.com/trustedsec/cve-2019-19781) and a forensic guide is available detailing how to check Citrix servers for evidence of a compromise (https://www.trustedsec.com/blog/netscaler-remote-code-execution-forensics/)

January 20 – UPDATED THREAT INTELLIGENCE:
Citrix releases fixed builds to address CVE-2019-19781 for Citrix ADC and Citrix Gateway versions 12.0 and 11.1. Additional fixed builds for vulnerable versions of Citrix ADC, Citrix Gateway, and Citrix SD-WAN WANOP are expected to be released on January 24th

SYSTEMS AFFECTED:

  • Citrix ADC and Citrix Gateway version 13.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.1 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 11.1 all supported builds
  • Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: HIGH
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: HIGH
Home Users:
MEDIUM

TECHNICAL SUMMARY:

A vulnerability has been discovered in the Citrix Application Delivery Controller Web Server which could allow for remote code execution. Successful exploitation of this vulnerability could allow for arbitrary code execution within the context of a privileged process. This vulnerability could be exploited by taking advantage of a directory traversal vulnerability and a vulnerability existing in the /vpns/ directory of the web server. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Apply the workaround provided by the Citrix advisory as there is currently no patch for this vulnerability
  • Apply appropriate patches provided by Citrix to vulnerable systems once available after appropriate testing.
  • Remind users not to download, accept, or execute files from un-trusted or unknown sources.
  • Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.
  • Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

***JANUARY 20 – UPDATED RECOMMENDATIONS:

  • Apply appropriate patches provided by Citrix for Citrix ADC and Citrix Gateway versions 12.0 and 11.1, after appropriate testing.
  • Apply the workaround provided by the Citrix advisory until fixes are released on January 24 for other vulnerable versions.
  • Remind users not to download, accept, or execute files from un-trusted or unknown sources.
  • Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.
  • Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

REFERENCES:

Carnegie Mellon University:
https://www.kb.cert.org/vuls/id/619785/

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Related Resources



Arrow CIS Control 3: Continuous Vulnerability Assessment and Remediation

Information Hub : Advisories


CONTROL: 1 --- ADVISORY CONTROL: 0
CONTROL: 2 --- ADVISORY CONTROL: 0

Pencil Media mention 21 Jan 2020
CONTROL: 3 --- ADVISORY CONTROL: 0
CONTROL: 4 --- ADVISORY CONTROL: 0