Threat Brief: RCE Vulnerability CVE-2023-3519 on Customer-Managed Citrix Servers
Summary: Citrix disclosed CVE-2023-3519, a remote code execution vulnerability with a CVSS score of 9.8, on July 18, 2023, affecting customer-managed NetScaler ADC and NetScaler Gateway appliances configured as a gateway or authentication server. CISA reported at least one attack in which a threat actor used the vulnerability as a zero-day to drop a PHP webshell on a critical infrastructure organization's NetScaler appliance, then enumerated and exfiltrated Active Directory data.
Why it matters: The attacker reached Active Directory from a single unpatched appliance, and only a segmented environment stopped further discovery - the same segmentation that many organizations lack around their remote-access gateways.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-3466CVE-2023-3467CVE-2023-3519
- Related
- CVE-2023-3519: Citrix Net Scaler ADC and Net Scaler Gateway Code Injection Vulnerability Known Exploited Vulnerabilities · Jul 19, 2023Will the real Citrix CVE-2023-3519 please stand up? Cyber Risks ·