NetScaler ADC and NetSCaler Gateway Security Bulletin for CVE-2023-24487, CVE-2023-24488

NetScaler ADC and NetSCaler Gateway Security Bulletin for CVE-2023-24487, CVE-2023-24488

Citrix published on May, 9th a new Security Bulletin for NetScaler ADC and Netscaler Gateway. The severity is rated as medium. AXACOM is recommending to upgrade the NetScaler ADCs and Gateways in the next few days according to the Citrix CTX477714.

Please monitor as well the Citrix CTX article under the following link:

https://support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202324487-cve202324488

Vulnerabilities have been discovered in Citrix ADC and Citrix Gateway listed below, that, if exploited, could result in the following security issues: 

Impacted Products, Versions and Components

The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability: 

  • Citrix ADC and Citrix Gateway 13.1 before 13.1-45.61
  • Citrix ADC and Citrix Gateway 13.0 before 13.0-90.11
  • Citrix ADC and Citrix Gateway 12.1 before 12.1-65.35
  • Citrix ADC 12.1-FIPS before 12.1-55.296
  • Citrix ADC 12.1-NDcPP before 12.1-55.296

This bulletin only applies to customer-managed Citrix ADC and Citrix Gateway. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action. 

CVE IDDescriptionPre-requisitesCWECVSS
CVE-2023-24488Cross site scriptingAppliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual serverCWE-796.1
CVE-2023-24487Arbitrary file readAccess to NSIP or SNIP with management interface accessCWE-2536.3

What Customers Should Do

Affected customers of Citrix ADC and Citrix Gateway are recommended to install the relevant updated versions of Citrix ADC or Citrix Gateway as soon as possible: 

  • Citrix ADC and Citrix Gateway 13.1-45.61 and later releases
  • Citrix ADC and Citrix Gateway 13.0-90.11 and later releases of 13.0  
  • Citrix ADC and Citrix Gateway 12.1-65.35 and later releases of 12.1  
  • Citrix ADC 12.1-FIPS 12.1-55.296 and later releases of 12.1-FIPS  
  • Citrix ADC 13.1-FIPS 13.1-37.150 and later releases of 13.1-FIPS  
  • Citrix ADC 12.1-NDcPP 12.1-55.296 and later releases of 12.1-NDcPP 
NetScaler ADC and NetSCaler Gateway Security Bulletin for CVE-2023-24487, CVE-2023-24488

Citrix Gateway and Citrix ADC Security Bulletin for CVE-2022-27510 CVE-2022-27513 and CVE-2022-27516

Description of Problem

Vulnerabilities have been discovered in Citrix Gateway and Citrix ADC, listed below. Note that only appliances that are operating as a Gateway (appliances using the SSL VPN functionality or deployed as an ICA proxy with authentication enabled) are affected by the first issue, which is rated as a Critical severity vulnerability. 

CVE-ID  Description  CWE  Affected Products Pre-conditions 
CVE-2022-27510 Unauthorized access to Gateway user capabilities CWE-288: Authentication Bypass Using an Alternate Path or Channel Citrix Gateway, Citrix ADC Appliance must be configured as a  VPN (Gateway) 
CVE-2022-27513 Remote desktop takeover via phishing CWE-345: Insufficient Verification of Data Authenticity Citrix Gateway, Citrix ADC Appliance must be configured as a  VPN (Gateway) and the RDP proxy functionality must be configured
CVE-2022-27516 User login brute force protection functionality bypass CWE-693: Protection Mechanism Failure Citrix Gateway, Citrix ADC Appliance must be configured as a  VPN (Gateway)          OR AAA virtual server  and the user lockout functionality “Max Login Attempts” must be configured 

The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability: 

  • Citrix ADC and Citrix Gateway 13.1 before 13.1-33.47 
  • Citrix ADC and Citrix Gateway 13.0 before 13.0-88.12 
  • Citrix ADC and Citrix Gateway 12.1 before 12.1.65.21
  • Citrix ADC 12.1-FIPS before 12.1-55.289 
  • Citrix ADC 12.1-NDcPP before 12.1-55.289 

This bulletin only applies to customer-managed Citrix ADC and Citrix Gateway appliances. Customers using Citrix-managed cloud services do not need to take any action.

Please monitor any changes on the Citrix article as well: https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516

NetScaler ADC and NetSCaler Gateway Security Bulletin for CVE-2023-24487, CVE-2023-24488

Citrix ADC and Citrix Gateway Security Bulletin for CVE-2022-27507 and CVE-2022-27508

Description of Problem

Vulnerabilities have been discovered in Citrix ADC and Citrix Gateway that, if exploited, could result in a denial of service. 

These vulnerabilities have the following identifiers: 

CVE-ID  Description  CWE  Pre-conditions 
CVE-2022-27507 Authenticated denial of service CWE-400: Uncontrolled Resource Consumption   VPN (Gateway) virtual server with  DTLS, and  either ‹HDX Insight for EDT traffic› or ‹SmartControl› is configured 
CVE-2022-27508 Unauthenticated denial of service CWE-400: Uncontrolled Resource Consumption   Appliance must be configured as a VPN (Gateway) or AAA virtual server 

Für detaillierte Informationen und weitere Schritte, folgen Sie bitte den Informationen im Original Citrix Artikel.


NetScaler ADC and NetSCaler Gateway Security Bulletin for CVE-2023-24487, CVE-2023-24488

Citrix Gateway Plug-in for Windows Security Bulletin for CVE-2022-21827

Description of Problem

A vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows). If exploited, this issue would allow an adversary, who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM. This issue has the following identifier: 

CVE-ID  Description  CWE  Pre-conditions 
CVE-2022-21827 Arbitrary corruption or deletion of files as SYSTEM CWE-284: Improper Access Control Local access to a machine that has the vulnerable plug-in installed 

The following supported versions of Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) are affected by this vulnerability: 

  • Citrix Gateway Plug-in for Windows versions before 21.9.1.2 

What Customers Should Do

This issue has been addressed in the following versions of Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows):

  • Citrix Gateway Plug-in for Windows version 21.9.1.2 and later releases 

Download Link: https://www.citrix.com/downloads/citrix-gateway/plug-ins/citrix-secure-access-client-for-windows.html

The original Citrix article can be found here: https://support.citrix.com/article/CTX341455

NetScaler ADC and NetSCaler Gateway Security Bulletin for CVE-2023-24487, CVE-2023-24488

Spring4Shell (CVE-2022-22963, CVE-2022-22965)

A zero-day exploit affecting the Spring Framework versions (5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions was made public on March 30, 2022, allowing an unauthenticated attacker to execute arbitrary code on the target system.

Citrix recommends that customers hosting affected web applications follow Spring’s recommendations. In addition, Citrix Web App Firewall (WAF) customers should consider the following recommendations to improve the security of their applications from this vulnerability.

The Citrix research team has released updated Citrix WAF signatures designed to mitigate in part the CVE-2022-22963, CVE-2022-22965 vulnerability. If you are using any of these Spring Framework versions (5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions), Citrix strongly recommends that you download the signatures version 79 and apply to your Citrix WAF deployments as an additional layer of protection for your applications. Signatures are compatible with the following software versions of Citrix Application Delivery Controller (ADC) 11.1, 12.0, 12.1, 13.0 and 13.1. Please note, versions 11.1 and 12.0 are end of life.

Citrix ADC Produkte sind selber nicht von der Sicherheitslücke betroffen.

Für alle Kunden, welche WAF nicht im Einsatz haben, gibt es auch eine Empfehlung seitens Citrix, die Sicherheitslücke mittels Responder Policy zu minimieren:

Citrix ADC Standard and Advanced edition customers, as well as Premium edition customers who do not have WAF signatures enabled, can use responder policies for protection as shown below. Please bind the responder policy to the appropriate bind point (vserver or global).

add responder policy mitigate_cve_2022_22963_22965 q^(HTTP.REQ.FULL_HEADER. SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.
CONTAINS("spring.cloud.function.routing-expression") || HTTP.REQ.BODY(8192).SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS(".classLoader"))^ DROP

Citrix recommends that Citrix WAF customers use the latest signature version, enable signatures auto-update, and subscribe to receive signature alert notifications. Citrix will continue to monitor this dynamic situation and update as new mitigations become available.

If any of your application availability is inadvertently impacted due to false positives resulting from above mentioned mitigation policies, Citrix recommends the following modifications to the policy. Please note that any end point covered by the exception_list may expose those assets to the risks from CVE-2022-22963, CVE-2022-22965.

Mehr Informationen sind hier zu finden:

https://www.citrix.com/blogs/2022/04/01/guidance-for-reducing-spring4shell-security-vulnerability-risk-with-citrix-waf/
Release Notes der WAF Signaturen:
https://docs.citrix.com/en-us/citrix-adc/current-release/application-firewall/signature-alerts/signature-update-version-79.html

Bei Fragen zum Update und dem Einsatz der Citrix ADC WAF bzw. der Signaturen, wenden Sie sich an unseren Support.