Hackers Exploit Critical Citrix Netscaler Flaw For Webshell Deployment

The purpose of this article is to discuss the exploitation of a critical vulnerability in Citrix NetScaler by hackers for the deployment of webshells. Recent reports indicate that threat actors have been taking advantage of a zero-day flaw, known as CVE-2023-3519, in the appliance. This vulnerability can be exploited if the appliance is configured as a Gateway or AAA Server. With a CVSS score of 9.8, the severity of this flaw is deemed critical. Citrix Systems has released patches to address the vulnerability.

In this attack, the hackers uploaded a malicious TGZ file on the ADC appliance, containing a setuid binary, webshell, and discovery script. This allowed them to carry out various unauthorized activities, such as viewing configuration files, conducting LDAP searches, and exfiltrating data. To identify vulnerable instances, Deutsche Telekom CERT developed a scan script, which revealed over 11,170 instances at risk. Organizations have implemented measures such as segmentation and deleting authorization config files to prevent further exploitation.

To assist organizations in detecting, mitigating, and preventing such attacks, CISA has released a comprehensive report using the MITRE ATT&CK Framework. It is recommended that organizations follow these guidelines to safeguard against potential breaches.

Key Takeaways

• There is a critical zero-day flaw in Citrix NetScaler (CVE-2023-3519) that can be exploited by threat actors if the appliance is configured as a Gateway or AAA Server.
• The flaw has a CVSS Score of 9.8 (Critical) and patches have been released by Citrix Systems to address it.
• Threat actors have been uploading malicious TGZ files on vulnerable ADC appliances, allowing them to perform activities such as viewing configuration files, conducting LDAP searches, and performing AD enumeration and data exfiltration.
• Detection and mitigation efforts include the development of scan scripts, identification of vulnerable instances, implementation of segmented environments, and the deletion of authorization config files by threat actors to prevent remote login.

Critical Vulnerability Details

The critical Citrix NetScaler zero-day flaw (CVE-2023-3519) allows threat actors to exploit the appliance if configured as a Gateway or AAA Server, with a CVSS score of 9.8. Citrix Systems has released patches to address this vulnerability. Exploitation techniques used by threat actors include uploading a malicious TGZ file on the ADC appliance. Upon exploitation, threat actors engage in various activities such as viewing the configuration file and conducting LDAP searches. The malicious TGZ file contains a setuid binary, webshell, and discovery script. Additionally, threat actors perform AD enumeration, data exfiltration, and decrypt NetScaler configuration files and keys. A scan script has been developed for CVE-2023-3519, and organizations have implemented segmented environments to prevent certain queries. Threat actors have also been observed deleting authorization config files to impede remote login.

Affected Products and Versions

Affected products and versions include NetScaler ADC and NetScaler Gateway versions 13.1 and 13.0, NetScaler ADC version 12.1 (end of life), NetScaler ADC 13.1-FIPS and 12.1-FIPS, and NetScaler ADC 12.1-NDcPP. These products are vulnerable to the critical Citrix NetScaler zero-day flaw (CVE-2023-3519) that has a CVSS score of 9.8. The potential impact of this vulnerability is significant, as threat actors can exploit it if the appliance is configured as a Gateway or AAA Server. To mitigate the risk, Citrix Systems has released patches for the affected products. However, it is important for organizations to ensure a smooth patching process to protect their systems from exploitation. It is crucial for organizations using any of the affected products and versions to apply the patches promptly to prevent unauthorized access and potential data breaches.

Detection and Mitigation Measures

To address the vulnerabilities associated with the discovered zero-day flaw, it is essential for organizations to implement effective detection and mitigation measures. Detection techniques play a crucial role in identifying any malicious activity related to the exploitation of the Citrix NetScaler zero-day flaw. Organizations can utilize scan scripts specifically developed for CVE-2023-3519, such as the one developed by Deutsche Telekom CERT. Additionally, Shadowserver’s identification of vulnerable instances can aid in detecting potential threats. Mitigation strategies involve implementing segmented environments to limit certain queries and prevent unauthorized access. It is also recommended to follow the comprehensive report released by CISA on the MITRE ATT&CK Framework, which provides valuable insights into prevention and mitigation techniques. By adopting these measures, organizations can enhance their defenses against the exploitation of the critical Citrix NetScaler flaw and minimize the potential impact of such attacks.

Frequently Asked Questions

How did threat actors exploit the Citrix NetScaler zero-day flaw?

Threat actors exploited the Citrix NetScaler zero-day flaw by uploading a malicious TGZ file on the affected appliance. They utilized various exploitation techniques, such as viewing the configuration file, conducting LDAP searches, and performing AD enumeration for data exfiltration. The impact assessment of this exploitation includes unauthorized access to sensitive information and potential compromise of the affected systems.

What activities did the threat actors perform after uploading the malicious TGZ file?

After uploading the malicious TGZ file, the threat actors performed activities such as AD enumeration, data exfiltration, viewing the NetScaler configuration file, conducting LDAP searches, and attempting failed exfiltration queries. They also utilized rebooting techniques to prevent remote login.

How did Deutsche Telekom CERT contribute to the detection and mitigation of the vulnerability?

Deutsche Telekom CERT contributed to the detection and mitigation of the vulnerability by developing a scan script for CVE-2023-3519. Additionally, they identified over 11,170 vulnerable Citrix ADC/Gateway instances and recommended organizations to implement a segmented environment and follow CISA’s report on detection, mitigation, and prevention.

What were some of the failed exfiltration queries attempted by the threat actors?

The threat actors attempted failed exfiltration queries, including subnet-wide scans for internal network and lateral movement, outbound network connectivity with ping commands, and subnet-wide host commands for DNS lookup. These techniques were used as part of their exploitation of the Citrix NetScaler flaw. The impact on affected organizations included unauthorized access to configuration files, LDAP searches, and data exfiltration. To mitigate this vulnerability, it is recommended that organizations follow the detection and mitigation strategies outlined in the CISA report on the MITRE ATT&CK Framework.

How does rebooting into Single User Mode help the threat actors cover their tracks?

Rebooting into single user mode is a technique used for system maintenance. However, in the context of threat actors, it helps cover their tracks by deleting artifacts and preventing privileged users from logging in remotely, thereby compromising system security.