Citrix warns admins to immediately patch NetScaler for actively exploited zero-days

Pierluigi Paganini
January 17, 2024

Citrix fixed two actively exploited zero-day vulnerabilities impacting Netscaler ADC and Gateway appliances.

Citrix warns customers to install security updates to address two actively exploited zero-day vulnerabilities, tracked as CVE-2023-6548 and CVE-2023-6549, impacting Netscaler ADC and Gateway appliances.

“Exploits of these CVEs on unmitigated appliances have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.” reads the advisory.

An attacker can trigger the flaw to gain remote code execution or cause a denial-of-service condition.

The vulnerability CVE-2023-6548 is an authenticated (low privileged) remote code execution affecting Management Interface. In order to exploit this issue, an attacker must have access to NSIP, CLIP or SNIP with management interface access.

The company pointed out that CVE- 2023- 6548 only impacts the management interface. Cloud Software Group strongly recommends that network traffic to the appliance’s management interface is separated, either physically or logically, from normal network traffic. The vendor recommends that customers do not expose the management interface to the internet, as explained in the secure deployment guide.

The vulnerability CVE-2023-6549 is a Denial of Service. To be exploited the appliance must be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.

Below is the list of Netscaler product versions:

• NetScaler ADC and NetScaler Gateway 14.1-12.35 and later releases
• NetScaler ADC and NetScaler Gateway  13.1-51.15 and later releases of 13.1
• NetScaler ADC and NetScaler Gateway 13.0-92.21 and later releases of 13.0  
• NetScaler ADC 13.1-FIPS 13.1-37.176 and later releases of 13.1-FIPS  
• NetScaler ADC 12.1-FIPS 12.1-55.302 and later releases of 12.1-FIPS  
• NetScaler ADC 12.1-NDcPP 12.1-55.302 and later releases of 12.1-NDcPP 

Citrix vulnerabilities were already exploited in the past in large-scale attacks. The critical Netscaler vulnerability CVE-2023-4966 was exploited by multiple threat actors in attacks against high-profile organizations.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Citrix NetScaler)