Citrix ADC/Gateway RCE Actively Exploited
A remote code execution flaw in Citrix ADC and Citrix Gateway is being actively exploited in the wild, with patches only rolling out in stages after initial disclosure.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2019-19781 as exploited in the wild.
IPA Japan issued an alert regarding a remote code execution vulnerability affecting Citrix ADC and Citrix Gateway appliances, widely used for network infrastructure. As of the initial January 17, 2020 disclosure, no vendor patch was available, leaving organizations exposed to exploitation that could allow arbitrary code execution, data tampering, and data exfiltration.
The alert was updated multiple times as Citrix released partial fixes on January 20, 24, and 27, 2020, eventually covering all affected versions. IPA confirmed that exploitation was already occurring in the wild and warned that damage could expand, urging urgent remediation. Notably, Citrix ADC 12.1 builds prior to versions 51.16, 51.19, and 50.31 had a defect causing the interim mitigation workaround to not function properly, requiring administrators to update to unaffected builds before applying mitigations.
This vulnerability, widely tracked in the security community as the "Shitrix" bug (CVE-2019-19781), was mass-exploited following public disclosure of proof-of-concept exploits, before patches were fully available across all affected versions, making it a high-priority remediation item for any organization running vulnerable Citrix ADC/Gateway deployments.
Mentioned in this report
Detection guidance
Citrix ADC/Gateway CVE-2019-19781 Directory Traversal Exploitation Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing the characteristic path traversal sequence used to exploit CVE-2019-19781 against Citrix ADC/Gateway VPN endpoints. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Citrix ADC/Gateway CVE-2019-19781 Path Traversal Exploitation Attempt
logsource:
category: proxy
detection:
selection:
cs-uri-stem|contains:
- /vpn/../vpns/
- /../vpns/portal/scripts/newbm.pl
- /../vpns/portal/scripts/rmbm.pl
condition: selection
fields:
- cs-uri-stem
- c-ip
- cs-host
falsepositives:
- Vulnerability scanners or penetration testers probing for CVE-2019-19781
- Security researchers actively testing for the vulnerability's presence
level: high
tags:
- attack.t1190
id: bd91d4d1-e251-5065-9ba3-5793c6b829dd
status: experimental
author: Vorant
Citrix ADC/Gateway Webshell Dropped via Portal Templates Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of XML files in the Citrix ADC/Gateway portal templates directory, a known post-exploitation technique for CVE-2019-19781 webshell persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Citrix ADC/Gateway Suspicious File Write in Portal Templates Directory
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: /netscaler/portal/templates/
TargetFilename|endswith: .xml
condition: selection
falsepositives:
- Legitimate administrative customization of Citrix Gateway portal templates
- Vendor-supplied firmware or configuration updates modifying template files
level: high
tags:
- attack.t1190
id: 8645ab18-e7dc-5a0f-bb48-28dbc8d43f9e
status: experimental
author: Vorant
Citrix ADC/Gateway Suspicious Perl Process Spawned by Web Server (CVE-2019-19781)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the NetScaler web server (httpd/nsppe) spawning a perl interpreter process, consistent with exploitation of CVE-2019-19781 leading to arbitrary code execution via crafted VPN template requests. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Citrix ADC/Gateway httpd Spawning Perl Process
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /nsppe
Image|endswith: /perl
condition: selection
falsepositives:
- Legitimate CGI perl scripts executed as part of normal NetScaler management interface
operation
level: medium
tags:
- attack.t1190
id: 0d80edb0-d189-5b39-b8c4-215b7433cadb
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2019/alert20200117.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs