Vulnerability in Citrix Application Delivery Controller (CVE-2019-19781) Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2020-002

DATE(S) ISSUED:

01/08/2020

OVERVIEW:

A vulnerability has been discovered in the Citrix Application Delivery Controller Web Server which could allow for remote code execution. Citrix Application Delivery Controller is a load balancer used for web, application, and database servers. Successful exploitation of this vulnerabilities could allow for arbitrary code execution within the context of a privileged process. Depending on the privileges associated with the web service, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

THREAT INTELLIGENCE:

There are currently no reports of this vulnerability being exploited in the wild.

SYSTEMS AFFECTED:

• Citrix ADC and Citrix Gateway version 13.0 all supported builds
• Citrix ADC and NetScaler Gateway version 12.1 all supported builds
• Citrix ADC and NetScaler Gateway version 12.0 all supported builds
• Citrix ADC and NetScaler Gateway version 11.1 all supported builds
• Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds

RISK:

TECHNICAL SUMMARY:

A vulnerability has been discovered in the Citrix Application Delivery Controller Web Server which could allow for remote code execution. Successful exploitation of this vulnerability could allow for arbitrary code execution within the context of a privileged process. This vulnerability could be exploited by taking advantage of a directory traversal vulnerability and a vulnerability existing in the /vpns/ directory of the web server. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

RECOMMENDATIONS:

We recommend the following actions be taken:

• Apply the workaround provided by the Citrix advisory as there is currently no patch for this vulnerability
• Apply appropriate patches provided by Citrix to vulnerable systems once available after appropriate testing.
• Remind users not to download, accept, or execute files from un-trusted or unknown sources.
• Remind users not to visit untrusted websites or follow links provided by unknown or un-trusted sources.
• Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

REFERENCES: