Citrix discloses critical NetScaler Gateway vulnerability
Users of affected products have been urged to implement patches immediately to mitigate risk
Citrix has issued a warning to users of NetScaler Gateway and ADC products over a series of new vulnerabilities.
In a security bulletin, the firm disclosed three new vulnerabilities, including one believed to have been actively exploited in the wild.
This included CVE-2023-3466, a reflected cross-site scripting (XSS) vulnerability, and CVE-2023-3467, which would enable escalation of privilege to root administrator, the firm revealed in its update.
The most severe of the three - identified as CVE-2023-3519 - would allow for unauthenticated remote code execution on affected Gateway appliances.
Analysis of the flaw from Rapid7 found that this vulnerability is “known to be exploited in the wild” and urged users to patch immediately.
RELATED RESOURCE
Three steps to transforming security operations
Read how to be more agile, effective, collaborative, and scalable
“This product line is a popular target for attackers of all skill levels, and we expect that exploitation will increase quickly,” researchers said.
“Rapid7 strongly recommends updating to a fixed version on an emergency basis, without waiting for a typical patch cycle to occur. See the Citrix advisory for more information.”
Security firm Tenable also analyzed the most severe flaw, which was given a severity score of 9.8 on the CVSSv3 scale, adding that although exploits have been observed, there is currently no known proof of concept code circulating in the wild.
Affected products
In its advisory, Citrix confirmed several versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities. These include:
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.13
- NetScaler ADC and NetScaler Gateway 13.0 before 13.0-91.13
- NetScaler ADC 13.1-FIPS before 13.1-37.159
- NetScaler ADC 12.1-FIPS before 12.1-65.36
- NetScaler ADC 12.1-NDcPP before 12.65.36
The advisory added that NetScaler ADC and NetScaler Gateway version 12.1 is now end-of-life (EOL) and thus vulnerable to the recently-disclosed flaws.
Customers currently using an EOL version have been advised to upgrade devices to the latest software versions with the patches applied.
These include:
- NetScaler ADC and NetScaler Gateway 13.1-49.13 and later releases
- NetScaler ADC and NetScaler Gateway 13.0-91.13 and later releases of 13.0
- NetScaler ADC 13.1-FIPS 13.1-37.159 and later releases of 13.1-FIPS
- NetScaler ADC 12.1-FIPS 12.1-65.36 and later releases of 12.1-FIPS
- NetScaler ADC 12.1-NDcPP 12.1-65.36 and later releases of 12.1-NDcPP
Customers and channel partners have been notified about the ongoing security risks, and will continue to receive updates via Citrix’s security bulletins.
-
North Korean hackers are duping freelance developers in a fake interview attack campaignNews A fake interview process uses coding tests and repo downloads to deliver malware
-
Liz Kendall: UK has to act fast to secure AI leadershipNews Tech secretary Liz Kendall has pledged greater investment in the chip and semiconductor technologies that underpin AI
-
Brace yourselves for a vulnerability explosion, Forescout warnsNews AI advances are helping identify software flaws at record pace and scale, but that's not the good news some would think
-
Ubuntu vulnerability exposes enterprises to root escalation, complete system compromiseNews The high-severity Ubuntu vulnerability allows an unprivileged local attacker to escalate privileges through the interaction of two standard system components
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
