Citrix ADC/Gateway RCE Actively Exploited

16 January 2020 critical vulnerability infrastructuretechnology

A remote code execution flaw in Citrix ADC and Citrix Gateway is being actively exploited in the wild, with patches only rolling out in stages after initial disclosure.

IPA Japan issued an alert regarding a remote code execution vulnerability affecting Citrix ADC and Citrix Gateway appliances, widely used for network infrastructure. As of the initial January 17, 2020 disclosure, no vendor patch was available, leaving organizations exposed to exploitation that could allow arbitrary code execution, data tampering, and data exfiltration.

The alert was updated multiple times as Citrix released partial fixes on January 20, 24, and 27, 2020, eventually covering all affected versions. IPA confirmed that exploitation was already occurring in the wild and warned that damage could expand, urging urgent remediation. Notably, Citrix ADC 12.1 builds prior to versions 51.16, 51.19, and 50.31 had a defect causing the interim mitigation workaround to not function properly, requiring administrators to update to unaffected builds before applying mitigations.

This vulnerability, widely tracked in the security community as the "Shitrix" bug (CVE-2019-19781), was mass-exploited following public disclosure of proof-of-concept exploits, before patches were fully available across all affected versions, making it a high-priority remediation item for any organization running vulnerable Citrix ADC/Gateway deployments.

Mentioned in this report

Vulnerabilities CVE-2019-19781KEV

Detection guidance

Citrix ADC/Gateway CVE-2019-19781 Directory Traversal Exploitation Attempt

ATT&CK T1190

Detects HTTP requests containing the characteristic path traversal sequence used to exploit CVE-2019-19781 against Citrix ADC/Gateway VPN endpoints. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Citrix ADC/Gateway CVE-2019-19781 Path Traversal Exploitation Attempt
logsource:
  category: proxy
detection:
  selection:
    cs-uri-stem|contains:
    - /vpn/../vpns/
    - /../vpns/portal/scripts/newbm.pl
    - /../vpns/portal/scripts/rmbm.pl
  condition: selection
fields:
- cs-uri-stem
- c-ip
- cs-host
falsepositives:
- Vulnerability scanners or penetration testers probing for CVE-2019-19781
- Security researchers actively testing for the vulnerability's presence
level: high
tags:
- attack.T1190
id: bd91d4d1-e251-5065-9ba3-5793c6b829dd
status: experimental
author: Vorant

Citrix ADC/Gateway Webshell Dropped via Portal Templates Directory

ATT&CK T1190

Detects creation of XML files in the Citrix ADC/Gateway portal templates directory, a known post-exploitation technique for CVE-2019-19781 webshell persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Citrix ADC/Gateway Suspicious File Write in Portal Templates Directory
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: /netscaler/portal/templates/
    TargetFilename|endswith: .xml
  condition: selection
falsepositives:
- Legitimate administrative customization of Citrix Gateway portal templates
- Vendor-supplied firmware or configuration updates modifying template files
level: high
tags:
- attack.T1190
id: 8645ab18-e7dc-5a0f-bb48-28dbc8d43f9e
status: experimental
author: Vorant

Citrix ADC/Gateway Suspicious Perl Process Spawned by Web Server (CVE-2019-19781)

ATT&CK T1190

Detects the NetScaler web server (httpd/nsppe) spawning a perl interpreter process, consistent with exploitation of CVE-2019-19781 leading to arbitrary code execution via crafted VPN template requests. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Citrix ADC/Gateway httpd Spawning Perl Process
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /httpd
    - /nsppe
    Image|endswith: /perl
  condition: selection
falsepositives:
- Legitimate CGI perl scripts executed as part of normal NetScaler management interface
  operation
level: medium
tags:
- attack.T1190
id: 0d80edb0-d189-5b39-b8c4-215b7433cadb
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20200117.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free