Flash Notice: Critical Zero-Day Vulnerability Found in Citrix NetScaler

overview

This week, a critical zero-day vulnerability (CVE-2023-4966) found in Citrix NetScaler is being exploited by attackers. The vulnerability has a CVSS score of 9.4 and was patched last week but has existed since August 2023. However, the researchers from Mandiant have said that the patch does not completely remediate the bug.  

CVE-2023-4966 allows attackers to take over authenticated sessions and potentially evade multifactor authentication (MFA), resulting in complete control over NetScaler environments, responsible for managing application delivery in businesses. These sessions can still exist even after applying the fix for CVE-2023-4966. Also, Mandiant has seen instances where session information was taken before the patch was applied and then exploited by an attacker. 

Currently, exploitation has been observed within the technology, professional services, and government sectors. Citrix stated in their advisory that customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication remain unaffected by CVE-2023-4966. The following versions of NetScaler ADC and Gateway appliances are impacted:  

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-8.50 
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.15 
• NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.19 
• NetScaler ADC 13.1-FIPS before 13.1-37.164 
• NetScaler ADC 12.1-FIPS before 12.1-55.300 
• NetScaler ADC 12.1-NDcPP before 12.1-55.300 
• NetScaler ADC and NetScaler Gateway version 12.1 is end-of-life but is still vulnerable.  

As a result of the initial patch being ineffective, Mandiant has provided steps for mitigating and reducing risks related to CVE-2023-4966. You can read their mitigation steps in their “Citrix NetScaler ADC/Gateway: CVE-2023-4966” document.  

avertium's recommendationS

Per Citrix, Cloud Software Group strongly urges customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions of NetScaler ADC and NetScaler Gateway as soon as possible:  

• NetScaler ADC and NetScaler Gateway 14.1-8.50  and later releases 
• NetScaler ADC and NetScaler Gateway  13.1-49.15  and later releases of 13.1 
• NetScaler ADC and NetScaler Gateway 13.0-92.19 and later releases of 13.0   
• NetScaler ADC 13.1-FIPS 13.1-37.164 and later releases of 13.1-FIPS   
• NetScaler ADC 12.1-FIPS 12.1-55.300 and later releases of 12.1-FIPS   
• NetScaler ADC 12.1-NDcPP 12.1-55.300 and later releases of 12.1-NDcPP  
• Because NetScaler ADC and NetScaler Gateway version 12.1 (end-of-life) is vulnerable, it is recommended that users upgrade to one of the supported versions.  

INDICATORS OF COMPROMISE (IoCs)

At this time, there are no known IoCs associated with CVE-2023-4966. Avertium remains vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.     

How Avertium is Protecting Our CUSTOMERS

• Expanding endpoints, cloud computing environments, and accelerated digital transformation have decimated the perimeter in an ever-expanding attack surface. Avertium offers Attack Surface Management, so you’ll have no more blind spots, weak links, or fire drills. See every threat in your attack surface, every device, every entry point, and every vulnerability. Our Attack Surface Management services include: 
  • Risk Assessments 
  • Pen Testing and Social Engineering 
  • Infrastructure Architecture and Integration 
  • Zero Trust Network Architecture 
  • Vulnerability Management 
• Fusion MXDR is the first MDR offering that fuse together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts. 

SUPPORTING DOCUMENTATION