Will the real Citrix CVE-2023-3519 please stand up?
Summary: Citrix disclosed CVE-2023-3519, a critical unauthenticated remote code execution vulnerability with a CVSS score of 9.8 affecting NetScaler ADC and NetScaler Gateway, but researchers found at least two vulnerabilities patched in the same upgrade. Rapid7 and AssetNote found a memory corruption flaw in ns_aaa_saml_parse_authn_request reachable via HTTP POST to "/saml/login", while Bishop Fox and GreyNoise identified a stack corruption flaw in ns_aaa_gwtest_get_event_and_target_names reachable via HTTP GET to "/gwtest/formssso" that was demonstrated to lead to remote code execution.
Bottom line: GreyNoise began observing exploitation attempts on July 28th, and the payloads it captured - 262 "A" characters followed by attempts to run /bin/sh -c reboot - would crash the nsppe program but fail to achieve code execution because the attacker appears unaware of the target's CPU endianness. The gap between a 9.8 CVSS score and an attacker who cannot yet land the exploit is the window you have to patch.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-3519
- Related
- CVE-2023-3519: Citrix Net Scaler ADC and Net Scaler Gateway Code Injection Vulnerability Known Exploited Vulnerabilities · Jul 19, 2023