Threat Brief: Citrix Bleed CVE-2023-4966
Summary: Citrix patched CVE-2023-4966, known as Citrix Bleed, in NetScaler ADC and NetScaler Gateway on Oct. 10, 2023; the flaw lets an unauthenticated attacker steal session tokens via a crafted request and hijack sessions, and carries a CVSS score of 9.4. Unit 42 researchers counted nearly 8,000 IP addresses advertising a vulnerable NetScaler Gateway and 6,000 advertising NetScaler ADC, with 3,100 in the United States, 800 in Germany, 450 in China and 400 in the United Kingdom, and the vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog.
Why it matters: Unit 42's Incident Response and Managed Threat Hunting teams observed ransomware groups exploiting Citrix Bleed, and Python scripts were reportedly distributed to ransomware affiliates to gain access to victim networks - with public proof-of-concept code already available and Citrix stating there is no workaround.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Mentions
- CVE-2023-4966CVE-2023-4967
- Related
- CVE-2023-4966 Helps Usher In A Baker’s Dozen Of Citrix Tags To Further Help Organizations Mitigate Harm | Grey Noise Blog Cyber Risks ·CVE-2023-4966: Citrix Net Scaler ADC and Net Scaler Gateway Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Oct 18, 2023Dragos Industrial Ransomware Analysis: Q4 2023 Cyber Risks ·