Citrix has issued a warning about a zero-day vulnerability affecting its NetScaler ADC and NetScaler Gateway appliances. The vulnerability is actively being exploited, and users are urged to patch their systems promptly.
It is important to note that the vulnerability only affects customer-managed appliances, while Citrix-provided cloud services or Adaptive Authentication services are not impacted.
The most critical vulnerability identified is CVE-2023-3519, which allows an unauthenticated attacker to execute remote code. The advisory clarifies that the appliance must be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server to be vulnerable. The advisory also mentions that exploits targeting unmitigated appliances have been observed.
The affected product versions include NetScaler ADC and NetScaler Gateway 13.1 before 13.1-49.13, NetScaler ADC and NetScaler Gateway 13.0 before 13.0-91.13, NetScaler ADC 13.1-FIPS before 13.1-37.159, NetScaler ADC 12.1-FIPS before 12.1-55.297, and NetScaler ADC 12.1-NDcPP before 12.1-55.297.
Although NetScaler ADC and Gateway 12.1 are also vulnerable, they have reached their end-of-life and will not receive patches.
In addition to CVE-2023-3519, two other vulnerabilities were identified. CVE-2023-3466 is a reflected cross-site scripting vulnerability that requires victim interaction for exploitation. CVE-2023-3467 is a privilege escalation bug.
Citrix strongly advises its users to apply the necessary patches and security updates to mitigate the risks associated with these vulnerabilities.
