Vulnerability in Citrix Application Delivery Controller (CVE-2019-19781) Could Allow for Arbitrary Code Execution

ITS Advisory Number: 
2020-002 - UPDATED
Date(s) Issued: 
Thursday, January 9, 2020
Date Updated: 
Wednesday, January 29, 2020
Subject: 
Vulnerability in Citrix Application Delivery Controller (CVE-2019-19781) Could Allow for Arbitrary Code Execution
Overview: 

A vulnerability has been discovered in the Citrix Application Delivery Controller Web Server which could allow for remote code execution. Citrix Application Delivery Controller is a load balancer used for web, application, and database servers. Successful exploitation of this vulnerabilities could allow for arbitrary code execution within the context of a privileged process. Depending on the privileges associated with the web service, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

 

January 28 - UPDATED:

NOTE: Fixed builds have been released across all supported versions of Citrix ADC and Citrix Gateway. Fixed builds have also been released for Citrix SD-WAN WANOP for the applicable appliance models. Citrix strongly recommends that customers install these updates at their earliest schedule. Information about the fixed builds can be found at the reference below.

 

THREAT INTELLIGENCE:

There are currently no reports of these vulnerabilities being exploited in the wild.

 

January 13 - UPDATED THREAT INTELLIGENCE:

TrustedSec announced the availability of proof-of-concept exploit code for CVE-2019-19781 flaw in Citrix NetScaler ADC and Citrix NetScaler Gateway servers. The PoC is available on github (; text-decoration:underline">https://github.com/trustedsec/cve-2019-19781) and a forensic guide is available detailing how to check Citrix servers for evidence of a compromise (; text-decoration:underline">https://www.trustedsec.com/blog/netscaler-remote-code-execution-forensics/).

 

January 21 - UPDATED THREAT INTELLIGENCE:

Citrix releases fixed builds to address CVE-2019-19781 for Citrix ADC and Citrix Gateway versions 12.0 and 11.1. Additional fixed builds for vulnerable versions of Citrix ADC, Citrix Gateway, and Citrix SD-WAN WANOP are expected to be released on January 24th.

 

January 22 - UPDATED THREAT INTELLIGENCE:

The following IP addresses have been observed attempting to leverage the exploit:

95.179.163[.]186

80.240.31[.]218

 

Observed Over Albert:

23.225.161[.]102

61.14.210[.]120

45.120.53[.]214

178.128.20[.]163

159.203.184[.]36

43.228.126[.]129

103.101.207[.]12

104.248.202[.]182

Systems Affected: 
  • Citrix ADC and Citrix Gateway version 13.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.1 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 11.1 all supported builds
  • Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds

January 28 - UPDATED SYSTEMS AFFECTED:

  • Citrix SD-WAN WANOP appliance models 4000-WO, 4100-WO, 5000-WO, and 5100-WO all supported software release builds before 10.2.6b and 11.0.3b

January 29 - UPDATED SYSTEMS AFFECTED:

  • Citrix ADC and Citrix Gateway version 13.0 all supported builds

  • Citrix ADC and NetScaler Gateway version 12.1 all supported builds

  • Citrix ADC and NetScaler Gateway version 12.0 all supported builds

  • Citrix ADC and NetScaler Gateway version 11.1 all supported builds

  • Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds

  • Citrix SD-WAN WANOP appliance models 4000-WO, 4100-WO, 5000-WO, and 5100-WO all supported software release builds before 10.2.6b and 11.0.3b

RISK
GOVERNMENT
Large and medium government entities: 
High
Small government entities: 
High
BUSINESS
Large and medium business entities: 
High
Small business entities: 
High
Home Users: 
Medium
Description: 

A vulnerability has been discovered in the Citrix Application Delivery Controller Web Server which could allow for remote code execution. Successful exploitation of this vulnerabilities could allow for arbitrary code execution within the context of a privileged process. This vulnerability could be exploited by taking advantage of a directory traversal vulnerability and a vulnerability existing in the /vpns/ directory of the web server. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

Actions: 
  • After appropriate testing, immediately apply the workaround provided by the Citrix advisory as there is currently no patch for this vulnerability.
  • Apply appropriate patches provided by Citrix to vulnerable systems once available after appropriate testing.
  • Remind users not to download, accept, or execute files from un-trusted or unknown sources.
  • Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.
  • Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

 

January 21 - UPDATED ACTIONS:

  • After appropriate testing, apply patches provided by Citrix for Citrix ADC and Citrix Gateway versions 12.0 and 11.1, to the vulnerable system.
  • Apply the workaround provided by the Citrix advisory until fixes are released on January 24 for other vulnerable versions.
  • Remind users not to download, accept, or execute files from un-trusted or unknown sources.
  • Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.
  • Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

JANUARY 29 - UPDATED ACTIONS:

  • If the mitigations were not previously applied in mid-December, it is currently recommended to wipe box/appliance clean before applying patches as many devices cannot be totally cleaned by tools provided by FireEye and Citrix.
  • After appropriate testing, immediately apply patches provided by Citrix to vulnerable systems.
  • Remind users not to download, accept, or execute files from un-trusted or unknown sources.
  • Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.
  • Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.