Addressing Cyberattacks on Citrix Devices Through NetScaler Vulnerability Exploitation

A critical vulnerability in Citrix NetScaler ADC and Gateway devices has been the focal point of an extensive cyberattack campaign aimed at stealing user credentials. IBM identified "at least 600 unique victim IP addresses hosting modified NetScaler Gateway login pages," primarily situated in the United States and Europe. This article delves into the technical intricacies of the vulnerability, its exploitation, and provides recommendations to counter the threat.

Technical Overview of the Vulnerability

CVE-2023-3519, designated with a CVSS score of 9.8, pertains to a severe code injection vulnerability. Patched by Citrix in July 2023, this flaw could enable unauthenticated remote code execution. For several months, attackers have leveraged this vulnerability to compromise susceptible devices and gain persistent access for future attacks.

Modus Operandi of the Attacks

IBM X-Force discovered this malicious activity. The attackers exploited the NetScaler vulnerability to insert a malevolent script into the HTML content of the authentication web page. This maneuver allows them to capture user credentials. Specifically, they deployed a web shell based on PHP to execute their malicious activities. This PHP web shell enabled them to insert custom code into the NetScaler Gateway login page. This custom code included a reference to a remotely hosted JavaScript file controlled by the attackers.

The Role of JavaScript in Data Harvesting

The embedded JavaScript code aimed to harvest form data containing usernames and passwords. When users attempted to authenticate themselves, this JavaScript code activated and sent the harvested credentials to a remote server via an HTTP POST method.

Recommendations for Countermeasures

1. Prompt Patch Application: Organizations should immediately apply patches to mitigate this vulnerability.
2. Change of Credentials: All default login credentials should be changed, given that the configuration files of NetScaler contain multiple credentials and certificates.
3. Incident Response Measures: Organizations should enact a series of incident response protocols:
   • Quarantine or disconnect potentially compromised hosts.
   • Reimage hosts that have been compromised.
   • Issue new account credentials.
   • Inspect artifacts like running processes, unusual authentications, and recent network activities.
4. Cleaning rc.netscaler: If the threat actor used /lash/nsconfig/rc.netscaler to rewrite a web shell during each reboot, it’s imperative to clean the rc.netscaler file as mentioned by the Cybersecurity and Infrastructure Security Agency (CISA).

Final Thoughts

The commencement date of this cyberattack campaign remains uncertain. However, the first observed alteration to a login page occurred on August 11, 2023. This suggests that the campaign has been active for around two months. Interestingly, no specific threat actor or group has yet been definitively linked to this campaign. Given the high CVSS score and the significant number of affected IP addresses, this issue warrants urgent attention and remediation efforts from organizations.