Citrix ADC/Gateway SAML authentication bypass enables remote code execution
Critical unauthenticated RCE vulnerability in Citrix ADC/Gateway with SAML configurations is actively exploited; immediate patching required.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2022-27518 as exploited in the wild.
Japan's IPA has issued an advisory concerning a critical arbitrary code execution vulnerability affecting Citrix ADC and Citrix Gateway network appliances. The vulnerability impacts systems configured as SAML Service Provider (SP) or SAML Identity Provider (IdP). Unauthenticated remote attackers can exploit this flaw to execute arbitrary code on affected systems.
Active exploitation of this vulnerability has been confirmed in the wild, prompting urgent warnings from IPA. The agency emphasizes the risk of expanding attacks and strongly recommends immediate application of security updates. Organizations using Citrix ADC or Gateway in SAML configurations should consult Citrix's guidance to verify their exposure and apply patches without delay.
Citrix has released patched versions addressing this vulnerability. Given the confirmed exploitation and the critical nature of remote code execution without authentication, this represents a significant threat to organizations relying on these appliances for network infrastructure and identity management.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from Citrix ADC/Gateway Web Daemon
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or scripting interpreter spawned as a child of Citrix ADC/Gateway daemon processes (e.g. nsppe, httpd, aslearn), consistent with post-exploitation of the unauthenticated SAML SP/IdP RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process from Citrix NetScaler Daemon
id: fbda7a3e-49d6-5208-b35c-5669efbec4b7
status: experimental
description: 'Citrix ADC/Gateway appliances configured as SAML SP or IdP are affected
by an unauthenticated RCE.
Successful exploitation typically results in the appliance''s web-facing daemon
processes
(e.g. nsppe, httpd, aslearn) spawning a shell or interpreter to execute attacker
commands.
This rule looks for that anomalous parent/child relationship on the appliance host.
'
references:
- https://www.ipa.go.jp/
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /nsppe
- /httpd
- /aslearn
- /nsaaad
- /nsconfigd
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /python3
- /perl
- /curl
- /wget
condition: selection_parent and selection_child
falsepositives:
- Legitimate NetScaler diagnostic or support scripts invoked by admins through documented
CLI utilities
- Vendor-supplied health-check or license-check scripts that shell out from daemon
processes
level: high
tags:
- attack.t1190
- attack.initial-access
author: Vorant
Outbound Network Connection Initiated by Citrix ADC/Gateway Appliance Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects outbound network connections initiated directly by Citrix NetScaler/ADC daemon processes, which may indicate a reverse shell or C2 callback following exploitation of the unauthenticated SAML RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Connection from Citrix NetScaler Daemon Process
id: 75c8b4a4-c951-52ce-bf09-0e60b1710388
status: experimental
description: 'Citrix ADC/Gateway processes such as nsppe, httpd or aslearn normally
do not initiate
outbound network connections to arbitrary external hosts. Following exploitation
of the
unauthenticated SAML SP/IdP RCE, attackers may cause these daemons to open reverse
shells
or beacon to attacker infrastructure. This rule flags outbound connections initiated
by
these appliance processes.
'
references:
- https://www.ipa.go.jp/
logsource:
category: network_connection
product: linux
detection:
selection:
Image|endswith:
- /nsppe
- /httpd
- /aslearn
- /nsaaad
- /nsconfigd
Initiated: true
filter_internal:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_internal
falsepositives:
- Legitimate license activation or update-check callbacks to Citrix cloud endpoints
- Monitoring or telemetry integrations configured to call external SIEM/analytics
services
level: medium
tags:
- attack.t1190
- attack.command-and-control
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/alert20221214.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,566 reports from 147 sources, 722 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs