Pierluigi Paganini November 22, 2023

Citrix urges admins to kill NetScaler user sessions after patching their appliances against the CVE-2023-4966 Citrix Bleed vulnerability.

Citrix is providing additional measures to admins who are patching their NetScaler appliances against the CVE-2023-4966 ‘Citrix Bleed‘ vulnerability.

The company is urging admins to drop all active user sessions and terminate all persistent ones. 

“If you are using any of the affected builds listed in the security bulletin, you should upgrade immediately by installing the updated versions.” reads the upgrade to the initial advisory. “After you upgrade, we recommend that you remove any active or persistent sessions using the following commands:

kill aaa session -all

kill icaconnection -all

kill rdp connection -all

kill pcoipConnection -all

clear lb persistentSessions

In late October, Citrix urged administrators to actively secure all NetScaler ADC and Gateway appliances against the CVE-2023-4966 vulnerability, which attackers were exploiting.

On October 10, Citrix published a security bulletin related to the critical vulnerability CVE-2023-4966 in Citrix NetScaler ADC/Gateway devices.

“Exploits of CVE-2023-4966 on unmitigated appliances have been observed.” reported Citrix. “Cloud Software Group strongly urges customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions of NetScaler ADC and NetScaler Gateway as soon as possible: 

• NetScaler ADC and NetScaler Gateway 14.1-8.50  and later releases
• NetScaler ADC and NetScaler Gateway  13.1-49.15  and later releases of 13.1
• NetScaler ADC and NetScaler Gateway 13.0-92.19 and later releases of 13.0  
• NetScaler ADC 13.1-FIPS 13.1-37.164 and later releases of 13.1-FIPS  
• NetScaler ADC 12.1-FIPS 12.1-55.300 and later releases of 12.1-FIPS  
• NetScaler ADC 12.1-NDcPP 12.1-55.300 and later releases of 12.1-NDcPP 

Note: NetScaler ADC and NetScaler Gateway version 12.1 is now End-of-Life (EOL). Customers are recommended to upgrade their appliances to one of the supported versions that address the vulnerabilities.”

Researchers from Mandiant observed the exploitation of this vulnerability as a zero-day since late August.

Threat actors exploited this vulnerability to hijack existing authenticated sessions and bypass multifactor authentication or other strong authentication requirements. The researchers warn that these sessions may persist even after deploying the update to mitigate CVE-2023-4966.

Mandiant also noted threat actors hijacking sessions, stealing session data before deploying the patch, and subsequently using it.

“The authenticated session hijacking could then result in further downstream access based upon the permissions and scope of access that the identity or session was permitted. A threat actor could utilize this method to harvest additional credentials, laterally pivot, and gain access to additional resources within an environment.” states Mandiant.

The attacks observed by Mandiant aimed at professional services, technology, and government organizations. 

The security firm published the CVE-2023-4966 guidance document for remediating and reducing risks related to this flaw.

The UC CISA warned that both nation-state hackers and cybercriminal gangs are actively exploiting the Citrix Bleed vulnerability. The US agency provided TTPs and IOCs shared by Boeing and related the intrusion attributed to LockBit 3.0 affiliates exploiting CVE-2023-4966.

“The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Multi-State Information Sharing & Analysis Center (MS-ISAC), and Australian Signals Directorate’s Australian Cyber Security Center (ASD’s ACSC) are releasing this joint Cybersecurity Advisory (CSA) to disseminate IOCs, TTPs, and detection methods associated with LockBit 3.0 ransomware exploiting CVE-2023-4966, labeled Citrix Bleed, affecting Citrix NetScaler web application delivery control (ADC) and NetScaler Gateway appliances.” reads the joint advisory published by CISA.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Citrix)