Critical Citrix NetScaler Vulnerability: Patch now!

Summary

Citrix has released a security advisory regarding two of its products, Citrix ADC and Citrix Gateway, when they are configured as a Gateway or AAA virtual server.  A related Critical vulnerability with a CVSS score of 9.4, CVE-2023-4966 , is under active targeted exploitation. This vulnerability has to do with sensitive information disclosure and was reported to have targeted attacks related to session hijacking.

Impact Assessment

Due to the related vulnerability’s severity and that it is under active targeted exploitation, the risk this vulnerability poses is high. The weakness ID associated is CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer, which is essentially a buffer overflow. If an attacker can exploit this according to MITRE, they may be able to execute arbitrary code, alter the intended control flow, read sensitive information, or cause the system to crash. This has caused reported instances of session hijacking allowing the attacker to take over the user’s session with whatever l session tokens they were interacting with at the time. This will allow the attacker to essentially login as another user and interact with devices and software with whatever level of permissions the user has.

The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities: 

1. NetScaler ADC and NetScaler Gateway 14.1 before 14.1-8.50
2. NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.15
3. NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.19
4. NetScaler ADC 13.1-FIPS before 13.1-37.164
5. NetScaler ADC 12.1-FIPS before 12.1-55.300
6. NetScaler ADC 12.1-NDcPP before 12.1-55.300

Note: NetScaler ADC and NetScaler Gateway version 12.1 is now End-of-Life (EOL) and is vulnerable.

Note: NetScaler ADC and NetScaler Gateway appliances that are not configured as a gateway (VPN virtual server, ICA proxy, CVPN, or RDP proxy) or as an AAA virtual server (traditional load balancing configurations, for example) and related products such as NetScaler Application Delivery Management (ADM) and Citrix SD-WAN are not affected.

What it means for you

CVE-2023-4966 has been rated as Critical and is under active exploitation. If remediation does not occur on any of the affected products, there is a much higher chance this will be exploited. An attacker may be able to execute arbitrary code, read sensitive data, hijack user sessions, or cause denial of service.

Remediation

CISA recommends following vendor instructions, which is to apply updates to the NetScaler ADC and NetScaler Gateway versions that are vulnerable. No mitigations for this vulnerability are available, so the update must be applied for remediation.

1. Update NetScaler ADC 
2. Update NetScaler Gateway

Before updating, the vendor recommends running the following commands to kill all active and persistent sessions.

kill icaconnection -all  kill rdp connection -all  kill pcoipConnection -all  kill aaa session -all  clear lb persistentSession

If you cannot update, CISA recommends discontinuing use of the product(s).  

Business Implications

Session hijacking is an attack which is being utilized with this vulnerability and it allows an attacker to execute arbitrary code, read sensitive data, or cause denial of service. Exploitation of this vulnerability can cause financial loss, reputational loss, and data loss. There will be costs associated with incident response, obtaining new hardware/software, PR, productivity loss, and training.

Access Point Technology Recommends

We recommend following vendor instructions and patching as soon as possible. This is a Critical vulnerability which is under active exploitation and was reported as a zero day. Emergency patching procedures should be in place and remediation is underway.

Associated Bulletins

https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967

https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

https://nvd.nist.gov/vuln/detail/CVE-2023-4966

https://cwe.mitre.org/data/definitions/119.html

https://owasp.org/www-community/attacks/Session_hijacking_attack