A vulnerability has been discovered in the Citrix Application Delivery Controller Web Server which could allow for remote code execution. Citrix Application Delivery Controller is a load balancer used for web, application, and database servers. Successful exploitation of this vulnerabilities could allow for arbitrary code execution within the context of a privileged process. Depending on the privileges associated with the web service, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

January 28 - UPDATED:

NOTE: Fixed builds have been released across all supported versions of Citrix ADC and Citrix Gateway. Fixed builds have also been released for Citrix SD-WAN WANOP for the applicable appliance models. Citrix strongly recommends that customers install these updates at their earliest schedule. Information about the fixed builds can be found at the reference below.

THREAT INTELLIGENCE:

There are currently no reports of these vulnerabilities being exploited in the wild.

January 13 - UPDATED THREAT INTELLIGENCE:

TrustedSec announced the availability of proof-of-concept exploit code for CVE-2019-19781 flaw in Citrix NetScaler ADC and Citrix NetScaler Gateway servers. The PoC is available on github (#0563c1; text-decoration:underline">https://github.com/trustedsec/cve-2019-19781) and a forensic guide is available detailing how to check Citrix servers for evidence of a compromise (#0563c1; text-decoration:underline">https://www.trustedsec.com/blog/netscaler-remote-code-execution-forensics/).

January 21 - UPDATED THREAT INTELLIGENCE:

Citrix releases fixed builds to address CVE-2019-19781 for Citrix ADC and Citrix Gateway versions 12.0 and 11.1. Additional fixed builds for vulnerable versions of Citrix ADC, Citrix Gateway, and Citrix SD-WAN WANOP are expected to be released on January 24th.

January 22 - UPDATED THREAT INTELLIGENCE:

The following IP addresses have been observed attempting to leverage the exploit:

95.179.163[.]186

80.240.31[.]218

Observed Over Albert:

23.225.161[.]102

61.14.210[.]120

45.120.53[.]214

178.128.20[.]163

159.203.184[.]36

43.228.126[.]129

103.101.207[.]12

104.248.202[.]182

Citrix ADC and Citrix Gateway version 13.0 all supported builds

Citrix ADC and NetScaler Gateway version 12.1 all supported builds

Citrix ADC and NetScaler Gateway version 12.0 all supported builds

Citrix ADC and NetScaler Gateway version 11.1 all supported builds

Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds

January 28 - UPDATED SYSTEMS AFFECTED:

Citrix SD-WAN WANOP appliance models 4000-WO, 4100-WO, 5000-WO, and 5100-WO all supported software release builds before 10.2.6b and 11.0.3b

January 29 - UPDATED SYSTEMS AFFECTED:

Citrix ADC and Citrix Gateway version 13.0 all supported builds

Citrix ADC and NetScaler Gateway version 12.1 all supported builds

Citrix ADC and NetScaler Gateway version 12.0 all supported builds

Citrix ADC and NetScaler Gateway version 11.1 all supported builds

Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds

Citrix SD-WAN WANOP appliance models 4000-WO, 4100-WO, 5000-WO, and 5100-WO all supported software release builds before 10.2.6b and 11.0.3b

• After appropriate testing, immediately apply the workaround provided by the Citrix advisory as there is currently no patch for this vulnerability.  
• Apply appropriate patches provided by Citrix to vulnerable systems once available after appropriate testing.  
• Remind users not to download, accept, or execute files from un-trusted or unknown sources.
•  Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.  
• Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

 January 21 - UPDATED ACTIONS:

• After appropriate testing, apply patches provided by Citrix for Citrix ADC and Citrix Gateway versions 12.0 and 11.1, to the vulnerable system. 
• Apply the workaround provided by the Citrix advisory until fixes are released on January 24 for other vulnerable versions.
• Remind users not to download, accept, or execute files from un-trusted or unknown sources. 
• Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.
• Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

JANUARY 29 - UPDATED ACTIONS:

If the mitigations were not previously applied in mid-December, it is currently recommended to wipe box/appliance clean before applying patches as many devices cannot be totally cleaned by tools provided by FireEye and Citrix.  After appropriate testing, immediately apply patches provided by Citrix to vulnerable systems.  Remind users not to download, accept, or execute files from un-trusted or unknown sources.  Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.  Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.