Note: This advisory uses the MITRE ATT&CK for Enterprise framework, version 13. If no compromise is detected, organizations should immediately apply patches provided by Citrix. If potential compromise is detected, organizations should apply the incident response recommendations provided in this CSA. CISA encourages critical infrastructure organizations to use the detection guidance included in this advisory for help with determining system compromise. This advisory provides tactics, techniques, and procedures (TTPs) and detection methods shared with CISA by the victim. Citrix released a patch for this vulnerability on July 18, 2023. The victim organization identified the compromise and reported the activity to CISA and Citrix. The actors attempted to move laterally to a domain controller but network-segmentation controls for the appliance blocked movement. The webshell enabled the actors to perform discovery on the victim’s active directory (AD) and collect and exfiltrate AD data.
In June 2023, threat actors exploited this vulnerability as a zero-day to drop a webshell on a critical infrastructure organization’s non-production environment NetScaler ADC appliance. The information above will generate the following link:Ĭitrixreceiver://createprofile/?s=https%3A%2F%%2F&pname=IPM-Portal&d=ipm.The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this Cybersecurity Advisory to warn network defenders about exploitation of CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. The first step is to go to the Citrix Mobile Receiver Setup URL Generator:Īfter entering the required information and clicking Generate URL, a link will be generated which can be embedded into your Web Interface or Access Gateway logon page.
The correct version of the Receiver must be downloaded, and configuration of the program usually entails one or more calls to the Help Desk.Ī simple modification to the Access Gateway or Web Interface login page can eliminate most (if not all) of those calls.
Mobile device support is accomplished via the Citrix Receiver. Just about all of our clients are reporting that Citrix mobile device support is being demanded by technical and non-technical users alike. Like it or not, iPads and other mobile devices are here to stay.
0 kommentar(er)
