SoatDev IT Consulting
SoatDev IT Consulting
  • About us
  • Expertise
  • Services
  • How it works
  • Contact Us
  • News
  • July 21, 2023
  • Rss Fetcher

Citrix NetScaler admins are being urged to install a patch released this week to plug a critical code injection hole in the company’s Application Delivery Controller (ADC) and Gateway products.
The warning comes from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which says threat actors have been exploiting the zero-day vulnerability (CVE-2023-3519) to drop a generic webshell on an unnamed critical infrastructure organization’s non-production environment.
The webshell enabled the hackers to search and exfiltrate Active Directory (AD) data. The actors attempted to move laterally to a domain controller, but network segmentation controls for the appliance blocked movement, the CISA says.
The affected products are
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.13
• NetScaler ADC and NetScaler Gateway 13.0 before 13.0-91.13
• NetScaler ADC and NetScaler Gateway version 12.1, now end of life
• NetScaler ADC 13.1-FIPS before 13.1-37.159
• NetScaler ADC 12.1-FIPS before 12.1-65.36
• NetScaler ADC 12.1-NDcPP before 12.65.36
The affected appliance must be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or authentication, authorization, and auditing (AAA) virtual server for exploitation.
The report also contains details about the techniques used by the attacker.
Through the webshell, the attacker viewed NetScaler configuration files /flash/nsconfig/keys/updated/* and /nsconfig/ns.conf.  These configuration files contain an encrypted password that can be decrypted by the key stored on the ADC appliance. They also viewed the NetScaler decryption keys (to decrypt the AD credential from the configuration file) and used the decrypted AD credential to query the AD via ldapsearch. Discovered data was then encrypted and compressed into a zip file for exfiltration.
The hacker’s other discovery activities were unsuccessful due to the critical infrastructure organization’s deployment of their NetScaler ADC appliance in a segmented environment.
The actors’ post-exploitation lateral movement attempts were also blocked by network-segmentation controls, says the report. The actors implanted a second webshell on the victim that they later removed. This was likely a PHP shell with proxying capability, the report theorizes. The actors likely used this to attempt proxying SMB traffic to the domain controller; the report notes the victim organization observed SMB connections where the actors attempted to use the previously decrypted AD credential to authenticate with the domain controller from the NetScaler ADC via a virtual machine. Firewall and account restrictions — only certain internal accounts could authenticate to the DC — blocked this activity.
In addition to installing the patch, administrators should also search for signs the vulnerability has been exploited. If compromise is detected, IT should quarantine or take offline potentially affected hosts, re-image compromised hosts and provision new account credentials.The post Admins warned to patch NetScaler appliances first appeared on IT World Canada.

Previous Post
Next Post

Recent Posts

  • Conheça o jogo Chicken Road em Portugal chickenroadcasino.pt
  • Descoperă jocul Plinko în România plinko-romania.ro
  • Remark raises $16M to build out human-powered expert models for e-commerce
  • Threads launches its own DM inbox, as app moves further away from Instagram
  • Chicken Road – Ein unterhaltsames Spiel aus der Schweiz chickenroadgame.ch

Categories

  • Industry News
  • Programming
  • RSS Fetched Articles
  • Uncategorized

Archives

  • July 2025
  • June 2025
  • May 2025
  • April 2025
  • February 2025
  • January 2025
  • December 2024
  • November 2024
  • October 2024
  • September 2024
  • August 2024
  • July 2024
  • June 2024
  • May 2024
  • April 2024
  • March 2024
  • February 2024
  • January 2024
  • December 2023
  • November 2023
  • October 2023
  • September 2023
  • August 2023
  • July 2023
  • June 2023
  • May 2023
  • April 2023

Tap into the power of Microservices, MVC Architecture, Cloud, Containers, UML, and Scrum methodologies to bolster your project planning, execution, and application development processes.

Solutions

  • IT Consultation
  • Agile Transformation
  • Software Development
  • DevOps & CI/CD

Regions Covered

  • Montreal
  • New York
  • Paris
  • Mauritius
  • Abidjan
  • Dakar

Subscribe to Newsletter

Join our monthly newsletter subscribers to get the latest news and insights.

© Copyright 2023. All Rights Reserved by Soatdev IT Consulting Inc.