Over 80,000 companies in 158 countries are at risk. In less than a minute, an external attacker can get inside the companies' internal networks.

Mikhail Klyuchnikov, Positive Technologies expert, discovered a critical vulnerability in Citrix Application Delivery Controller¹ (NetScaler ADC) and Citrix Gateway (NetScaler Gateway). If that vulnerability is exploited, attackers obtain direct access to the company's local network from the Internet. This attack does not require access to any accounts, and therefore can be performed by any external attacker.

Positive Technologies experts determined that at least 80,000 companies in 158 countries are potentially at risk. The top 5 countries with such organizations include the United States (the absolute leader, with over 38 percent of all vulnerable organizations), the UK, Germany, the Netherlands, and Australia.

The discovered vulnerability was assigned identifier CVE-2019-19781. The vendor has not officially assigned a CVSS severity level to this vulnerability yet, but Positive Technologies experts believe it has the highest level, a 10². This vulnerability affects all supported versions of the product, and all supported platforms, including Citrix ADC and Citrix Gateway 13.0, Citrix ADC and NetScaler Gateway 12.1, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1, and also Citrix NetScaler ADC and NetScaler Gateway 10.5.

Depending on specific configuration, Citrix applications can be used for connecting to workstations and critical business systems (including ERP). In almost every case, Citrix applications are accessible on the company network perimeter, and are therefore the first to be attacked. This vulnerability allows any unauthorized attacker to not only access published applications, but also attack other resources of the company's internal network from the Citrix server. Citrix released a set of measures to mitigate this vulnerability, insisting on immediate update of all vulnerable software versions to the recommended ones.

"Citrix applications are widely used in corporate networks. This includes their use for providing terminal access of employees to internal company applications from any device via the Internet. Considering the high risk brought by the discovered vulnerability, and how widespread Citrix software is in the business community, we recommend information security professionals take immediate steps to mitigate the threat," says Dmitry Serebryannikov, Director of Security Audit Department, Positive Technologies. "On a separate note, we want to point out that the vendor responded very promptly, by creating and releasing a set of risk mitigation measures within just a couple of weeks after the vulnerability was discovered. From our experience, we know that in many cases it can take months."

To fend off potential attacks, companies can also use web application firewalls. For example, PT Application Firewall can detect this attack out of the box. The system must be set to block all dangerous requests to ensure protection in real time. Considering how long this vulnerability has been around (since the first vulnerable version of the software was released in 2014), detecting potential exploitation of this vulnerability (and, therefore, infrastructure compromise) retrospectively becomes just as important. Starting December 18, 2019, PT Network Attack Discovery users can use special rules detecting attempts to exploit this vulnerability online.

In 2012, Positive Technologies experts detected and helped to eliminate multiple vulnerabilities in Citrix XenServer.

1. Citrix ADC is a software-oriented solution for delivering applications and balancing the load. It was specifically designed to increase the operation speed of traditional, cloud-based, and web-based applications, no matter where they are located. Stratistics MRC analysts expect the global market of this type of application delivery controllers to grow by 6.8 percent, reaching almost USD 5 billion (4.98 billion) by 2023. The analysts believe such controllers are already widespread, mostly in the IT and telecom industries. By 2023, the demand for ADCs for banks, financial and insurance companies will increase.
2. Vulnerabilities of such severity are not often found in the products of leading software manufacturers. In this case, the frequency may be five to ten years.