Discovery of a vulnerability exploiting CVE-2023-4966.

A critical security vulnerability in the Citrix environment was published on October 10, 2023, regarding NetScaler ADC and NetScaler Gateway.
An update was issued on November 20 to provide further details.

This vulnerability allows an attacker to exploit Citrix Netscaler ADC and Netscaler Gateway appliances configured as a Gateway, VPN virtual server, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server. This is tracked as CVE-2023-4966.

The LockBit ransomware group is actively targeting vulnerable appliances.

Affected products:

  • NetScaler ADC and NetScaler Gateway 14.1.x versions prior to 14.1-8.50
  • NetScaler ADC and NetScaler Gateway 13.1.x versions prior to 13.1-49.15
  • NetScaler ADC and NetScaler Gateway 13.0.x versions prior to 13.0-92.19
  • NetScaler ADC 13.1-FIPS versions prior to 13.1-37.164
  • NetScaler ADC 12.1-FIPS versions prior to 12.1-55.300
  • NetScaler ADC 12.1-NDcPP versions prior to 12.1-55.300
Citrix indicates that NetScaler ADC and NetScaler Gateway version 12.1 are End of Life (EOL).

Potential impacts:

– Remote code execution
– Breach of confidential data

Remediation:

Update your affected appliances listed above as soon as possible.
After updating your devices, ITrust recommends terminating all active or persistent sessions using the following commands:

kill aaa session -all
kill icaconnection -all
kill rdp connection -all
kill pcoipConnection -all
clear lb persistentSessions

Investigate for potential indicators of compromise:
Please check whether any sessions are performing abnormal activities within your network, particularly those related to virtual desktops, if configured.
Review logs related to "SSLVPN TCPCONNSTAT" where the 'Client_ip' and
'Source' fields differ. Please note that this does not necessarily indicate illegitimate activity.

Additional recommendations:

Use IS security mechanisms: SIEM, EDR, or contact your cybersecurity monitoring provider (managed SOC).

> Do not leave these types of services exposed and unprotected. ITrust provides tools to detect cyberthreats, ransomware, viruses, and anomalous behavior within your IS, such as our Reveelium UEBA SIEM.

> Regularly scan your network to detect security vulnerabilities and patches to apply. Our vulnerability scanner IKare, available as a free trial, enables the detection of new security flaws.

If you need assistance in remediating these vulnerabilities, call us. (+33 5 67 34 67 80)

*Sources:
https://cybersecuritynews.com/citrix-netscaler-zero-day-exploited/
https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-012/

NetScaler investigation recommendations for CVE-2023-4966Â