# MA-964.082023: MyCERT Advisory - CVE-2023-3519 - Exploitation of Citrix NetScaler ADC and NetScaler Gateway Vulnerability

**Date:** 16 Aug 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-964.082023  
**Advisory ID:** MA-964.082023

---

**1.0 Introduction**
MyCERT received information from trusted security parties about the exploitation of CVE-2023-3519, a critical unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. Security researchers from the Shadowserver Foundation, a non-profit organization dedicated to enhancing internet security, [revealed](https://twitter.com/Shadowserver/status/1682355280317919233) this week [that at least 15,000 appliances](https://dashboard.shadowserver.org/statistics/combined/map/?map_type=std&day=2023-07-19&source=http_vulnerable&source=http_vulnerable6&tag=cve-2023-3519%2B&geo=all&data_set=count&scale=log) were identified as exposed to [attacks leveraging the flaw (CVE-2023-3519)](https://www.bleepingcomputer.com/news/security/new-critical-citrix-adc-and-gateway-flaw-exploited-as-zero-day/) based on their version information. The vulnerability is rated **CVSS 9.8** critical.
Hence, we are issuing this security advisory to alert organizations about the exploitation of CVE-2023-3519, a critical unauthenticated remote code execution (RCE) vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. This advisory provides comprehensive information regarding the threat actors' activities, detection methods, incident response, and recommended mitigations. The exploitation of CVE-2023-3519 poses a significant threat to organizations using Citrix NetScaler ADC and NetScaler Gateway. By understanding the threat actor's tactics, techniques, and procedures outlined in this advisory, organizations can enhance their defence mechanisms, quickly detect compromise, and effectively respond to incidents. It is crucial to apply the recommended mitigations and continuously validate security controls to reduce the risk of successful exploitation.
**2.0 Impact**
The vulnerability allows attackers to execute arbitrary code on the affected systems, potentially leading to the implantation of webshells and unauthorized access to sensitive information.
**3.0 Threat Actor Activity**
In June 2023, threat actors exploited CVE-2023-3519, using it as a zero-day vulnerability to compromise a critical infrastructure organization's non-production NetScaler ADC appliance. The attackers utilized a multi-stage attack chain, uploading a TGZ file containing a generic webshell, a discovery script, and a setuid binary onto the appliance. The attackers proceeded to conduct SMB scanning, AD enumeration, and exfiltration of AD data using the webshell.
Specifically, the threat actors performed the following actions:
- Accessed configuration files to retrieve encrypted passwords and decryption keys.
- Used decrypted credentials to query Active Directory for users, computers, groups, and other objects.
- Encrypted collected discovery data and exfiltrated it as an image file.
- Attempted network and subnet-wide discovery and lateral movement, which was thwarted by network-segmentation controls.
**4.0 Affected Products**
- NetScaler ADC and NetScaler Gateway?13.1?before?13.1-49.13
- NetScaler ADC and NetScaler Gateway?13.0?before 13.0-91.13
- NetScaler ADC 13.1-FIPS before 13.1-37.159
- NetScaler ADC 12.1-FIPS before 12.1-55.297
- NetScaler ADC 12.1-NDcPP before 12.1-55.297
The affected appliance must be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or authentication, authorization, and auditing (AAA)?virtual?server for exploitation.
Note: NetScaler ADC and NetScaler Gateway version 12.1 is now End Of Life (EOL) and is vulnerable.
**5.0 Recommendations**
To detect potential compromise or unauthorized activity 
- Monitor for files created or modified after the last installation date.
- Inspect HTTP error logs for unusual requests containing ".sh" and ".php" extensions.
- Check shell logs for unauthorized post-exploitation commands.
- Review network and firewall logs for subnet-wide scanning and spikes in AD/LDAP traffic.
- Examine large outbound transfers from the affected device over a short period of session time as it can indicate signs of data exfiltration.
- Review logs for unusual authentication attempts and connections.
- Implement robust network segmentation controls on NetScaler appliances.
Organisations should also follow these mitigations and best practices:
- Apply the latest patches provided by Citrix for the affected versions as soon as possible. See [Citrix ADC and Citrix Gateway Security Bulletin for CVE-2023-3519, CVE-2023-3466, and CVE-2023-3467](https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467) for patch information.
- Enforce phishing-resistant multifactor authentication (MFA) for all staff and services.
- Implement network segmentation controls on internet-facing devices.
- Continually test and validate security controls against the techniques outlined in this advisory using the MITRE ATT&CK framework.
In case of compromise, organisations should:
1. Quarantine or take affected hosts offline.
2. Reimage compromised hosts.
3. Provision new account credentials.
4. Collect and review relevant artefacts and logs.
5. Report the compromise to relevant authorities, your service provider or to MyCERT.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
1. <https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a>
2. <https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467>
3. <https://www.shadowserver.org/news/technical-summary-of-observed-citrix-cve-2023-3519-incidents/>
4. <https://www.bleepingcomputer.com/news/security/over-15k-citrix-servers-vulnerable-to-cve-2023-3519-rce-attacks/>