# Critical unauthenticated RCE vulnerability in Citrix ADC/Gateway with SAML configurations…

Published: 2022-12-13 · Severity: critical
Canonical: https://vorant.io/reports/12fafbbe-b290-4e43-95ef-5537556cdb41/critical-unauthenticated-rce-vulnerability-in-citrix-adc-gateway-with-saml

> Critical unauthenticated RCE vulnerability in Citrix ADC/Gateway with SAML configurations is actively exploited; immediate patching required.

Japan's IPA has issued an advisory concerning a critical arbitrary code execution vulnerability affecting Citrix ADC and Citrix Gateway network appliances. The vulnerability impacts systems configured as SAML Service Provider (SP) or SAML Identity Provider (IdP). Unauthenticated remote attackers can exploit this flaw to execute arbitrary code on affected systems.

Active exploitation of this vulnerability has been confirmed in the wild, prompting urgent warnings from IPA. The agency emphasizes the risk of expanding attacks and strongly recommends immediate application of security updates. Organizations using Citrix ADC or Gateway in SAML configurations should consult Citrix's guidance to verify their exposure and apply patches without delay.

Citrix has released patched versions addressing this vulnerability. Given the confirmed exploitation and the critical nature of remote code execution without authentication, this represents a significant threat to organizations relying on these appliances for network infrastructure and identity management.

## Mentioned in this report

- Vulnerabilities: CVE-2022-27518 (KEV)

## Detection guidance (public sample)

### Suspicious Child Process Spawned from Citrix ADC/Gateway Web Daemon

ATT&CK: T1190

Detects a shell or scripting interpreter spawned as a child of Citrix ADC/Gateway daemon processes (e.g. nsppe, httpd, aslearn), consistent with post-exploitation of the unauthenticated SAML SP/IdP RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process from Citrix NetScaler Daemon
id: fbda7a3e-49d6-5208-b35c-5669efbec4b7
status: experimental
description: 'Citrix ADC/Gateway appliances configured as SAML SP or IdP are affected
  by an unauthenticated RCE.

  Successful exploitation typically results in the appliance''s web-facing daemon
  processes

  (e.g. nsppe, httpd, aslearn) spawning a shell or interpreter to execute attacker
  commands.

  This rule looks for that anomalous parent/child relationship on the appliance host.

  '
references:
- https://www.ipa.go.jp/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /nsppe
    - /httpd
    - /aslearn
    - /nsaaad
    - /nsconfigd
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /python
    - /python3
    - /perl
    - /curl
    - /wget
  condition: selection_parent and selection_child
falsepositives:
- Legitimate NetScaler diagnostic or support scripts invoked by admins through documented
  CLI utilities
- Vendor-supplied health-check or license-check scripts that shell out from daemon
  processes
level: high
tags:
- attack.t1190
- attack.initial-access
author: Vorant
```

### Outbound Network Connection Initiated by Citrix ADC/Gateway Appliance Process

ATT&CK: T1190

Detects outbound network connections initiated directly by Citrix NetScaler/ADC daemon processes, which may indicate a reverse shell or C2 callback following exploitation of the unauthenticated SAML RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Connection from Citrix NetScaler Daemon Process
id: 75c8b4a4-c951-52ce-bf09-0e60b1710388
status: experimental
description: 'Citrix ADC/Gateway processes such as nsppe, httpd or aslearn normally
  do not initiate

  outbound network connections to arbitrary external hosts. Following exploitation
  of the

  unauthenticated SAML SP/IdP RCE, attackers may cause these daemons to open reverse
  shells

  or beacon to attacker infrastructure. This rule flags outbound connections initiated
  by

  these appliance processes.

  '
references:
- https://www.ipa.go.jp/
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
    - /nsppe
    - /httpd
    - /aslearn
    - /nsaaad
    - /nsconfigd
    Initiated: true
  filter_internal:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal
falsepositives:
- Legitimate license activation or update-check callbacks to Citrix cloud endpoints
- Monitoring or telemetry integrations configured to call external SIEM/analytics
  services
level: medium
tags:
- attack.t1190
- attack.command-and-control
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/alert20221214.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/12fafbbe-b290-4e43-95ef-5537556cdb41/critical-unauthenticated-rce-vulnerability-in-citrix-adc-gateway-with-saml.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup