Pierluigi Paganini
January 17, 2024
Citrix warns customers to install security updates to address two actively exploited zero-day vulnerabilities, tracked as CVE-2023-6548 and CVE-2023-6549, impacting Netscaler ADC and Gateway appliances.
“Exploits of these CVEs on unmitigated appliances have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.” reads the advisory.
An attacker can trigger the flaw to gain remote code execution or cause a denial-of-service condition.
The vulnerability CVE-2023-6548 is an authenticated (low privileged) remote code execution affecting Management Interface. In order to exploit this issue, an attacker must have access to NSIP, CLIP or SNIP with management interface access.
The company pointed out that CVE- 2023- 6548 only impacts the management interface. Cloud Software Group strongly recommends that network traffic to the appliance’s management interface is separated, either physically or logically, from normal network traffic. The vendor recommends that customers do not expose the management interface to the internet, as explained in the secure deployment guide.
The vulnerability CVE-2023-6549 is a Denial of Service. To be exploited the appliance must be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
Below is the list of Netscaler product versions:
Citrix vulnerabilities were already exploited in the past in large-scale attacks. The critical Netscaler vulnerability CVE-2023-4966 was exploited by multiple threat actors in attacks against high-profile organizations.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Citrix NetScaler)
