Security Bulletin with an exclamation point in the center of the image

< BACK TO BLOG

CVE-2023-4966: Critical Data Exposure Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway

Share :

On October 10, 2023, Citrix issued a security bulletin describing a critical vulnerability in NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (CVE-2023-4966, CVSS: 9.4). This vulnerability enables an unauthenticated remote threat actor to access memory outside the intended buffer boundaries when certain operations are performed on a memory buffer. The appliance must meet the pre-requisite of being configured as a Gateway (VPN virtual server, ICA proxy, CVPN, RDP Proxy) or AAA virtual server to be vulnerable to CVE-2023-4966. The specifics of which type of data a threat actor can access has not been disclosed by Citrix. 

 

Product  Vulnerability  Affected Version 

Citrix NetScaler ADC (formerly Citrix ADC) 

CVE-2023-4966 
  • 14.1 before 14.1-8.50 
  • 13.1 before 13.1-49.15 
  • 13.0 before 13.0-92.19 
  • 13.1-FIPS before 13.1-37.164 
  • 12.1-FIPS before 12.1-55.300 
  • 12.1-NDcPP before 12.1-55.300 

Citrix NetScaler Gateway (formerly Citrix Gateway) 

CVE-2023-4966 
  • 14.1 before 14.1-8.50 
  • 13.1 before 13.1-49.15 
  • 13.0 before 13.0-92.19 

 

Note: Citrix NetScaler ADC and Citrix NetScaler Gateway version 12.1 is now End-of-Life (EOL) and is vulnerable. 

At this time, Arctic Wolf has not observed a public Proof of Concept (PoC) or active exploitation of this vulnerability in the wild. Citrix products are an attractive target for threat actors, as observed earlier in the year when threat actors were exploiting a critical remote code execution (RCE) vulnerability in Citrix ADC and Citrix Gateway. Multiple Citrix vulnerabilities have also been added to CISA’s Known Exploited Vulnerabilities Catalog.  

This security bulletin only applies to customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway products. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication are not affected by this vulnerability. 

Recommendation for CVE-2023-4966 

Upgrade Citrix NetScaler ADC and Citrix NetScaler Gateway to Fixed Version  

Arctic Wolf strongly recommends installing the updated versions Citrix NetScaler ADC and Citrix NetScaler Gateway.  

Product  

 Affected Version  Fixed Version 

Citrix NetScaler ADC (formerly Citrix ADC) 
  • 14.1 before 14.1-8.50 
  • 13.1 before 13.1-49.15 
  • 13.0 before 13.0-92.19 
  • 13.1-FIPS before 13.1-37.164 
  • 12.1-FIPS before 12.1-55.300 
  • 12.1-NDcPP before 12.1-55.300 
  • 14.1-8.50  and later releases 
  • 13.1-49.15  and later releases of 13.1 
  • 13.0-92.19 and later releases of 13.0  
  • 13.1-FIPS 13.1-37.164 and later releases of 13.1-FIPS   
  • 12.1-FIPS 12.1-55.300 and later releases of 12.1-FIPS  
  • 12.1-NDcPP 12.1-55.300 and later releases of 12.1-NDcPP   

Citrix NetScaler Gateway (formerly Citrix Gateway) 
  • 14.1 before 14.1-8.50 
  • 13.1 before 13.1-49.15 
  • 13.0 before 13.0-92.19 
  • 14.1-8.50  and later releases 
  • 13.1-49.15  and later releases of 13.1 
  • 13.0-92.19 and later releases of 13.0   

 

Please follow your organization’s patching and testing guidelines to avoid operational impact. 

References 

  1. Citrix Bulletin (CVE-2023-4966)
  2. Arctic Wolf Citrix ADC/Gateway Blog 
Picture of Andres Ramos

Andres Ramos

Andres Ramos is a Threat Intelligence Researcher at Arctic Wolf with a strong background in tracking emerging threats and producing actionable intelligence for both technical and non-technical stakeholders. He has a diverse background encompassing various domains of cyber security, holds a degree in Cybersecurity Engineering, and is a CISSP.
Share :
Table of Contents
Categories
Subscribe to our Monthly Newsletter

Continue Reading