Citrix has identified an isolated issue in which some customers experienced a crash condition after upgrading to the current build with HTTP/2 enabled.
What Product is Affected?
NetScaler appliance upgraded to version NS13.1 Build 45.63 or NS13.0 Build 90.11
*No other versions are impacted by this HTTP/2 issue.
Is there a workaround or fix?
Workaround: Disable http2 in the HTTP profile bound to the virtual server.
Fix: Engineering is working on a code fix and will update the ETA of the next build as soon as possible.
How to verify if http2 is enabled?
Run the following command from the CLI and verify if http2Direct Is reported as enabled.
> show run | grep http2
Example of output if enabled:
> set ns httpProfile <name of httpprofile> -http2 ENABLED -http2Direct ENABLED
Example of output if not enabled:
> set ns httpProfile <name of httpprofile> -http2 DISABLED -http2Direct DISABLED
How to disable http2 if enabled?
> set ns httpProfile <name of the httpprofile> -http2 DISABLED -http2Direct DISABLED
Citrix published on May, 9th a new Security Bulletin for NetScaler ADC and Netscaler Gateway. The severity is rated as medium. AXACOM is recommending to upgrade the NetScaler ADCs and Gateways in the next few days according to the Citrix CTX477714.
Please monitor as well the Citrix CTX article under the following link:
Vulnerabilities have been discovered in Citrix ADC and Citrix Gateway listed below, that, if exploited, could result in the following security issues:
Impacted Products, Versions and Components
The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability:
Citrix ADC and Citrix Gateway 13.1 before 13.1-45.61
Citrix ADC and Citrix Gateway 13.0 before 13.0-90.11
Citrix ADC and Citrix Gateway 12.1 before 12.1-65.35
Citrix ADC 12.1-FIPS before 12.1-55.296
Citrix ADC 12.1-NDcPP before 12.1-55.296
This bulletin only applies to customer-managed Citrix ADC and Citrix Gateway. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action.
CVE ID
Description
Pre-requisites
CWE
CVSS
CVE-2023-24488
Cross site scripting
Appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Affected customers of Citrix ADC and Citrix Gateway are recommended to install the relevant updated versions of Citrix ADC or Citrix Gateway as soon as possible:
Citrix ADC and Citrix Gateway 13.1-45.61 and later releases
Citrix ADC and Citrix Gateway 13.0-90.11 and later releases of 13.0
Citrix ADC and Citrix Gateway 12.1-65.35 and later releases of 12.1
Citrix ADC 12.1-FIPS 12.1-55.296 and later releases of 12.1-FIPS
Citrix ADC 13.1-FIPS 13.1-37.150 and later releases of 13.1-FIPS
Citrix ADC 12.1-NDcPP 12.1-55.296 and later releases of 12.1-NDcPP
Vulnerabilities have been discovered in Citrix Gateway and Citrix ADC, listed below. Note that only appliances that are operating as a Gateway (appliances using the SSL VPN functionality or deployed as an ICA proxy with authentication enabled) are affected by the first issue, which is rated as a Critical severity vulnerability.
CVE-ID
Description
CWE
Affected Products
Pre-conditions
CVE-2022-27510
Unauthorized access to Gateway user capabilities
CWE-288: Authentication Bypass Using an Alternate Path or Channel
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway)
CVE-2022-27513
Remote desktop takeover via phishing
CWE-345: Insufficient Verification of Data Authenticity
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway) and the RDP proxy functionality must be configured
CVE-2022-27516
User login brute force protection functionality bypass
CWE-693: Protection Mechanism Failure
Citrix Gateway, Citrix ADC
Appliance must be configured as a VPN (Gateway) OR AAA virtual server and the user lockout functionality “Max Login Attempts” must be configured
The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability:
Citrix ADC and Citrix Gateway 13.1 before 13.1-33.47
Citrix ADC and Citrix Gateway 13.0 before 13.0-88.12
Citrix ADC and Citrix Gateway 12.1 before 12.1.65.21
Citrix ADC 12.1-FIPS before 12.1-55.289
Citrix ADC 12.1-NDcPP before 12.1-55.289
This bulletin only applies to customer-managed Citrix ADC and Citrix Gateway appliances. Customers using Citrix-managed cloud services do not need to take any action.
Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, 2016, and 2019. The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker.
What Customers Should Do
To protect your on-prem Exchange you can bind a responder policy on the Citrix ADC contentswitch handling all the Exchange related traffic:
Vulnerabilities have been discovered in Citrix Application Delivery Management (Citrix ADM) that, if exploited, could result in the following security issues:
Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the default administrator credentials after the device has rebooted.
Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM.
CVE-ID
Description
CWE
Pre-conditions
CVE-2022-27511
Corruption of the system by a remote, unauthenticated user potentially leading to the reset of the administrator password
CWE-284: Improper Access Control
Access to ADM IP
CVE-2022-27512
Temporary disruption of the ADM license service
CWE-664: Improper Control of a Resource Through its Lifetime
Access to ADM IP
Da der ADM Zugangsdaten & Zugriff auf die konfigurierten Instanzen hat, wird empfohlen die Sicherheitslücke rasch zu schliessen in dem die ADM Instanz auf eine der folgenden Versionen aktualisiert wird:
Citrix ADM 13.1-21.53 and later versions of 13.1
Citrix ADM 13.0-85.19 and later versions of 13.0
Als Mitigation kann versucht werden die ADM Management IP über eine Firewall zu sperren.
Normalerweise ist das ADM nur von intern zugänglich wodurch das Risiko einer Ausnutzung der Schwachstelle relativ klein ist. Ein Angreifer müsste bereits Zugang zum internen Netz haben. Wie die Schwachstelle ausgenutzt werden kann ist bisher unbekannt.
Für detaillierte Informationen und weitere Schritte, folgen Sie bitte den Informationen im Original Citrix Artikel. Gerne unterstützen wir Sie bei bedarf bei dem Update.
