certfr_alerte - certfr-2023-ale-008

CERTFR-2023-ALE-008

Vulnerability from certfr_alerte

Le 18 juillet 2023, Citrix a publié un avis de sécurité concernant plusieurs vulnérabilités. La plus critique, dont l'identifiant CVE est CVE-2023-3519, permet à un attaquant non authentifié d'exécuter du code arbitraire à distance.

L'équipement est vulnérable s'il est configuré en tant que passerelle (Gateway : VPN virtual server, ICA Proxy, CVPN, RDP Proxy) ou en tant que serveur virtuel AAA (AAA virtual server).

L'éditeur indique que les produits NetScaler ADC et NetScaler Gateway en version 12.1 sont en fin de vie. Les clients sont invités à migrer vers une version supportée et à jour des correctifs de sécurité.

Citrix indique que cette vulnérabilité est activement exploitée. Le CERT-FR recommande donc fortement d'appliquer le correctif dans les plus brefs délais.

Détection d'une compromission

[mise à jour du 20 juillet 2023] La CISA a documenté une méthode de recherche des signes d'une compromission de l'équipement [2].

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'application seule des correctifs n'est pas suffisante. Il est fortement recommandé d'effectuer une analyse des systèmes [2]. En cas de suspicion de compromission, il est recommandé de continuer les investigations afin de déterminer les actions prises par un éventuel attaquant [1].

None

Impacted products

Vendor	Product	Description
Citrix	NetScaler ADC	NetScaler ADC 13.1-FIPS antérieures à 13.1-37.159
Citrix	N/A	NetScaler ADC et NetScaler Gateway versions 13.1-x antérieures à 13.1-49.13
Citrix	NetScaler ADC	NetScaler ADC 12.1-FIPS antérieures à 12.1-55.297
Citrix	N/A	NetScaler ADC et NetScaler Gateway versions 13.0-x antérieures à 13.0-91.13
Citrix	NetScaler ADC	NetScaler ADC 12.1-NDcPP antérieures à 12.1-55.297

References

Title

Publication Time

Tags

Bulletin de sécurité Citrix CTX561482 du 18 juillet 2023	None	vendor-advisory
[2] Avis CISA aa23-201a du 20 juillet 2023	-	other
Avis CERT-FR CERTFR-2023-AVI-0568 du 19 juillet 2023	-	other
[1] Les bons réflexes en cas d’intrusion sur un système d’information	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NetScaler ADC 13.1-FIPS ant\u00e9rieures \u00e0 13.1-37.159",
      "product": {
        "name": "NetScaler ADC",
        "vendor": {
          "name": "Citrix",
          "scada": false
        }
      }
    },
    {
      "description": "NetScaler ADC et NetScaler Gateway versions 13.1-x ant\u00e9rieures \u00e0 13.1-49.13",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Citrix",
          "scada": false
        }
      }
    },
    {
      "description": "NetScaler ADC 12.1-FIPS ant\u00e9rieures \u00e0 12.1-55.297",
      "product": {
        "name": "NetScaler ADC",
        "vendor": {
          "name": "Citrix",
          "scada": false
        }
      }
    },
    {
      "description": "NetScaler ADC et NetScaler Gateway versions 13.0-x ant\u00e9rieures \u00e0 13.0-91.13",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Citrix",
          "scada": false
        }
      }
    },
    {
      "description": "NetScaler ADC 12.1-NDcPP ant\u00e9rieures \u00e0 12.1-55.297",
      "product": {
        "name": "NetScaler ADC",
        "vendor": {
          "name": "Citrix",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2024-01-02",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n\nL\u0027application seule des correctifs n\u0027est pas suffisante. Il est\nfortement recommand\u00e9 d\u0027effectuer une analyse des syst\u00e8mes \\[2\\]. En cas\nde suspicion de compromission, il est recommand\u00e9 de continuer les\ninvestigations afin de d\u00e9terminer les actions prises par un \u00e9ventuel\nattaquant \\[1\\].\n",
  "cves": [
    {
      "name": "CVE-2023-3519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3519"
    }
  ],
  "initial_release_date": "2023-07-19T00:00:00",
  "last_revision_date": "2024-01-02T00:00:00",
  "links": [
    {
      "title": "[2] Avis CISA aa23-201a du 20 juillet 2023",
      "url": "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
    },
    {
      "title": "Avis CERT-FR CERTFR-2023-AVI-0568 du 19 juillet 2023",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2023-AVI-0568/"
    },
    {
      "title": "[1] Les bons r\u00e9flexes en cas d\u2019intrusion sur un syst\u00e8me d\u2019information",
      "url": "https://www.cert.ssi.gouv.fr/les-bons-reflexes-en-cas-dintrusion-sur-un-systeme-dinformation/"
    }
  ],
  "reference": "CERTFR-2023-ALE-008",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-07-19T00:00:00.000000"
    },
    {
      "description": "Ajout d\u0027informations pour la d\u00e9tection d\u0027une compromission",
      "revision_date": "2023-07-21T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2024-01-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Le 18 juillet 2023, Citrix a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant\nplusieurs vuln\u00e9rabilit\u00e9s. La plus critique, dont l\u0027identifiant CVE est\nCVE-2023-3519, permet \u00e0 un attaquant non authentifi\u00e9 d\u0027ex\u00e9cuter du code\narbitraire \u00e0 distance.\n\nL\u0027\u00e9quipement est vuln\u00e9rable s\u0027il est configur\u00e9 en tant que passerelle\n(*Gateway : VPN virtual server, ICA Proxy, CVPN, RDP Proxy*) ou en tant\nque serveur virtuel AAA (*AAA\u202fvirtual\u202fserver*).\n\nL\u0027\u00e9diteur indique que les produits NetScaler ADC et NetScaler Gateway en\nversion 12.1 sont en fin de vie. Les clients sont invit\u00e9s \u00e0 migrer vers\nune version support\u00e9e et \u00e0 jour des correctifs de s\u00e9curit\u00e9.\n\nCitrix indique que cette vuln\u00e9rabilit\u00e9 est activement exploit\u00e9e. Le\nCERT-FR recommande donc fortement d\u0027appliquer le correctif dans les plus\nbrefs d\u00e9lais.\n\n## D\u00e9tection d\u0027une compromission\n\n\u003cstrong\u003e\u003cspan style=\"color: #ff0000;\"\u003e\\[mise \u00e0 jour du 20 juillet\n2023\\]\u003c/span\u003e\u003c/strong\u003e La CISA a document\u00e9 une m\u00e9thode de recherche des signes\nd\u0027une compromission de l\u0027\u00e9quipement \\[2\\].\n",
  "title": "[M\u00e0J] Vuln\u00e9rabilit\u00e9 dans Citrix NetScaler ADC et NetScaler Gateway",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Citrix CTX561482 du 18 juillet 2023",
      "url": "https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467"
    }
  ]
}

CVE-2023-3519 (GCVE-0-2023-3519)

Vulnerability from cvelistv5

Published

2023-07-19 17:51

Modified

2025-10-21 23:05

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Summary

Unauthenticated remote code execution

References

URL

Tags

	https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
	http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html

Impacted products

Vendor

Product

Version

Citrix

NetScaler ADC

Version: 13.1
Version: 13.0
Version: 13.1-FIPS
Version: 12.1-FIPS
Version: 12.1-NDcPP

Citrix

NetScaler Gateway

Version: 13.1
Version: 13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:55:03.597Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3519",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-12-09T05:05:15.372531Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-07-19",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-3519"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:42.716Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-3519"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-07-19T00:00:00+00:00",
            "value": "CVE-2023-3519 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NetScaler ADC",
          "vendor": "Citrix",
          "versions": [
            {
              "lessThan": "49.13",
              "status": "affected",
              "version": "13.1",
              "versionType": "patch"
            },
            {
              "lessThan": "91.13",
              "status": "affected",
              "version": "13.0",
              "versionType": "patch"
            },
            {
              "lessThan": "37.159",
              "status": "affected",
              "version": "13.1-FIPS",
              "versionType": "patch"
            },
            {
              "lessThan": "55.297",
              "status": "affected",
              "version": "12.1-FIPS",
              "versionType": "patch"
            },
            {
              "lessThan": "55.297",
              "status": "affected",
              "version": "12.1-NDcPP",
              "versionType": "patch"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NetScaler Gateway",
          "vendor": "Citrix",
          "versions": [
            {
              "lessThan": "49.13",
              "status": "affected",
              "version": "13.1",
              "versionType": "patch"
            },
            {
              "lessThan": "91.13",
              "status": "affected",
              "version": "13.0",
              "versionType": "patch"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnauthenticated remote code execution\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Unauthenticated remote code execution"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-04T17:06:36.277Z",
        "orgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6",
        "shortName": "Citrix"
      },
      "references": [
        {
          "url": "https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467"
        },
        {
          "url": "http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e437aed5-38e0-4fa3-a98b-cb73e7acaec6",
    "assignerShortName": "Citrix",
    "cveId": "CVE-2023-3519",
    "datePublished": "2023-07-19T17:51:39.739Z",
    "dateReserved": "2023-07-05T22:22:26.251Z",
    "dateUpdated": "2025-10-21T23:05:42.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2023-ALE-008

Vulnerability from certfr_alerte

Détection d'une compromission

Solution

CVE-2023-3519 (GCVE-0-2023-3519)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature