Many servers remain unpatched, researchers are warning.
Numerous Citrix ADC and Gateway servers continue to be susceptible to critical vulnerabilities that were reportedly patched by the company weeks ago, according to experts.
Citrix discovered and patched an “Unauthorized access to Gateway user capabilities” flaw in early November 2022; this flaw is now known as CVE-2022-27510. Affected by both products, this vulnerability enables an attacker to gain authorized access to target endpoints (opens in new tab), take remote control of the devices, and bypass the device’s brute force login protection.
Approximately one month later, in mid-December, the company patched a flaw identified as CVE-2022-27518, “Unauthenticated remote arbitrary code execution.” This vulnerability allows threat actors to remotely execute malicious code on the target endpoint.
NSA caution
At least one of them was exploited in the wild as a zero-day vulnerability, according to researchers from NCC Group’s Fox-IT team.
The US National Security Agency (NSA) issued a warning in early December that a hacking group supported by the Chinese government was exploiting the zero-day security flaw.
In an official blog post at the time, Citrix’s chief security and trust officer, Peter Lefkowitz, stated that “limited exploits of this vulnerability have been reported,” but did not specify the number of attacks or the affected industries.
This group of threat actors, sometimes referred to as Manganese, appears to have specifically targeted networks running these Citrix applications to bypass organizational security without having to first steal credentials via social engineering and phishing attacks.
While the majority of endpoints have been patched since the release of the fixes, there are “thousands” of vulnerable servers out there, according to the researchers. At least 28,000 Citrix servers were found to be vulnerable as of 11 November 2022.
The researchers concluded, “We hope this blog increases awareness of these two Citrix CVEs and that our research on version identification contributes to future studies.”
