Wednesday, May 22, 2024

Hackers Scanning for Citrix Servers Vulnerable to Remote Code Execution

Researchers spotted active scans targeting Application Delivery Controller and Citrix Gateway to exploit Critical Vulnerability CVE-2019-19781.

This vulnerability can be exploited remotely, successful exploitation allows an unauthenticated attacker to perform arbitrary code execution.

The vulnerability was discovered by Mikhail Klyuchnikov, it may create a serious threat for organizations deployed with Citrix Application Delivery Controller and gateway.

Active Scans Spotted

SANS Technology Institute Dean of Research, Johannes B. Ullrich, spotted active scans through honeypot logs. The good news is that no exploits are being used.

Johannes said that the scans are not sophisticated, as they have some of the errors. He also said that “the attackers were able to create a code execution exploit.”

Multiple requests were spotted started from the basic level to some dangerous requests. The requests don’t trigger the exploit as it’s parts are missing, but they hit the vulnerable URLs.

Another researcher Kevin Beaumont said that active exploitation for the vulnerability is starting up.

https://twitter.com/GossiTheDog/status/1214892555306971138

According to Citrix advisory the vulnerability affects following product versions platforms.

  • Citrix ADC and Citrix Gateway version 13.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.1 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 11.1 all supported builds
  • Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds

Citrix not released any patches, but suggested configuration changes to mitigate the execution vulnerability.

Citrix believed to be used in more than 80,000 companies around the globe, successful exploitation of the vulnerability allows an unauthenticated attacker to access internal company applications.

Citrix strongly urges affected customers to immediately apply the provided mitigation. Customers should then upgrade all of their vulnerable appliances to a fixed version of the appliance firmware when released.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Website

Latest articles

Hackers Claiming Access to Qatar National Bank Database

A group of hackers has claimed to have accessed the database of Qatar National...

Cloud-Based Malware Attack Abusing Google Drive & Dropbox

A phishing email with a malicious zip attachment initiates the attack. The zip contains...

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles