Citrix ADC / NetScaler Gateway < 13.1-49.13 — RCE
Unauthenticated remote code execution on Citrix ADC and Gateway devices. Apply vendor patch immediately — exploited as a zero-day and subsequently mass-exploited by LockBit, Medusa, and other ransomware groups targeting government and healthcare.
An unauthenticated attacker can execute arbitrary code on the Citrix appliance, access session tokens for currently authenticated users, and pivot into the internal network. Attackers used this to harvest session tokens (hence the "Citrix Bleed" name) enabling them to impersonate users without credentials.
Citrix ADC and Gateway have a stack-based buffer overflow in the HTTP/S handling of the management interface or VPN virtual server when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server.
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
CVE-2023-3519 was disclosed on July 18, 2023. By late 2023, over 10,000 organisations had been compromised. Boeing, Toyota Financial Services, and multiple US government agencies were confirmed victims. LockBit ransomware operators automated exploitation to rapidly move from initial access to ransomware deployment. CISA issued multiple advisories and ran a voluntary scanning campaign.
Manual remediation steps
⏱ 45 minutes including appliance restartCheck Current Version
From the Citrix ADC CLI:
sh version
Check for Active Sessions / Compromise Indicators
# List current ICA/VPN sessions
sh ica session
sh vpn session
# Check for unexpected admin accounts
sh system user
# Check for recently modified files
find /netscaler -newer /var/nslog/ns.log -type f 2>/dev/null | head -20
Apply the Patch
install build <filename.tgz> -Y
Post-Patch: Terminate All Active Sessions
# Kill all active ICA sessions (important — session tokens may be compromised)
kill ica session -all
kill vpn session -all
Verify
sh version
# Must show 13.1-49.13 or later
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References