Code Injection in Citrix Netscaler ADC and Citrix NetScaler Gateway - CVE-2023-3519

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. A remote non-authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Affected software

How to mitigate CVE-2023-3519

Links to Public Exploits and PoC-codes

• Exploit #10523 - CVE-2023-3519 (Stack-Overflow on Citrix) (September 20, 2024)
• Exploit #10109 - cve-2023-3519 () (June 21, 2024)
• Exploit #10108 - cve-2023-3519-citrix-scanner (Citrix Scanner for CVE-2023-3519) (June 21, 2024)
• Exploit #9394 - citrix CVE-2023-3519 (October 25, 2023)
• Exploit #9255 - CVE-2023-3519 (POC Citrix vulnerability scanner. Auto Exploit) (August 22, 2023)
• Exploit #9229 - CVE-2023-3519 (RCE exploit for CVE-2023-3519) (August 6, 2023)
• Exploit #9221 - Citrix ADC (NetScaler) Forms SSO Target RCE (August 3, 2023)

External References

• https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467

Related Security Bulletins

• Multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway