Exploits in the Wild for Citrix ADC and Citrix Gateway Directory Traversal Vulnerability CVE-2019-19781
Summary: A directory traversal vulnerability in Citrix Application Delivery Controller and Citrix Gateway, tracked as CVE-2019-19781 with a 9.8 CVSS v3.1 score, lets unauthenticated remote attackers read sensitive configuration files and execute arbitrary code across all supported product versions and platforms. Unit 42 found scanning and exploitation activity in the wild, a Shodan search returned roughly 700 exposed Citrix ADC results, and Citrix released Security Bulletin CTX267027 and mitigation steps CTX267679 on December 17, 2019, with a patch promised for late January.
Bottom line: The flaw needs no authentication and leads to remote code execution, and roughly 700 Citrix ADC instances were already visible on Shodan, so the exposed population is large and easy to find. Palo Alto Networks shipped protection on January 7, 2020, yet public reports of successful exploitation followed on January 11 - a gap that matters if your mitigation was still pending.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2019-19781
- Related
- CVE-2019-19781: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Threat Advisory: NSA SVR Advisory Coverage Cyber Risks ·