CVE-2019-19781 - Citrix Gateway and ADC - remote code execution

[Kevin Beaumont 111]

The boilerplate description

"A vulnerability has been identified in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution."

What it means in practice

Unauthenticated remote code execution on internet connected Citrix Gateway devices = bad.

Are attackers actually exploiting this vulnerability?

Yes, at scale, against targeted and untargeted assets.

Impact

Lame stuff like coin miners, but also devices getting backdoored, and people trying to use this to deploy ransomware inside Windows orgs behind the Citrix boxes.

Vendor advisory and patches

Here: https://support.citrix.com/article/CTX267027

Checking if your device has already been exploited

Check out this tool, which is getting frequent updates: https://github.com/fireeye/ioc-scanner-CVE-2019-19781/tree/v1.2

Scale of the issue

Somewhere in the region of ~100k devices were exploitable with this back in December.  After have a huge awareness campaign via all sorts of orgs, this one is about ~10k unpatched devices at present.  Those orgs are still in serious danger of exploitation.

If you patched late

You want to run the FireEye tool linked above to look for exploitation, as attackers may have backdoored your device.

I just applied the mitigations

You should also apply the patch, as it hardens the setup - just the mitigations alone present some issues.

Edited January 27, 2020 by Kevin Beaumont
typo

[Nicholas L 7]

On a note, if using our tool (FireEye linked above), make sure to keep updating as actors are actively trying to evade it.