Citrix NetScaler ADC/Gateway Unauthenticated RCE
- Product
- Citrix NetScaler ADC / Gateway
- CVE
- CVE-2023-3519
- Disclosed
- 2023-07-18
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- NetScaler ADC/Gateway 13.1 before 13.1-49.13, 13.0 before 13.0-91.13, 13.1-FIPS before 13.1-37.159, 12.1-FIPS/NDcPP before 12.1-55.297 (12.1 EOL also affected) when configured as Gateway or AAA virtual server.
- Fixed
- 13.1-49.13, 13.0-91.13, 13.1-FIPS 13.1-37.159, 12.1-FIPS/NDcPP 12.1-55.297.
Summary
A memory-safety bug in NetScaler appliances configured as a Gateway or AAA virtual server allowed unauthenticated remote code execution. It was exploited as a zero-day against a US critical-infrastructure organization and later used to implant webshells on thousands of devices.
Root cause
A stack-based buffer overflow in the nsppe packet-processing engine when parsing attacker-supplied parameters on gateway authentication endpoints. Researchers (Assetnote, Bishop Fox) traced it to unsafe copying of request values into fixed-size stack buffers, allowing control of execution flow.
Impact
Root-level code execution on the appliance; observed post-exploitation included webshells and AD enumeration.
Detection
Check for unexpected PHP files in /netscaler/ns_gui/ and /var/vpn/, unusual child processes of nsppe, and crashes in ns.log. Compare build numbers against the fixed versions; Mandiant and Citrix released IOC scanners.
Mitigation
Upgrade to fixed builds and hunt for webshells, since patching does not remove an existing compromise.