Article
NetScaler exposed edge: questions to ask your team
What a NetScaler ADC or Gateway owner does first: list appliances, check for compromise before patching, and keep management services off the internet.
Read more
Exploited vulnerability
Citrix ADC and Gateway code execution (CVE-2023-3519)
CVE-2023-3519
CVE-2023-3519 is a flaw in NetScaler ADC and NetScaler Gateway, formerly Citrix ADC and Gateway.
- On CISA KEV
- CVE ID
- CVE-2023-3519
- CISA KEV
- Listed
- Affected product
- NetScaler ADC and NetScaler Gateway
- Exploited
- Yes
- Published
- July 2023
In short
CVE-2023-3519 is a flaw in NetScaler ADC and NetScaler Gateway, formerly Citrix ADC and Gateway. It lets an outsider with no login run code on the appliance when it is set up as a Gateway or an AAA virtual server. CISA reported it was used as a zero-day in June 2023.
- CVECVE-2023-3519
- ProductCitrix (Cloud Software Group) NetScaler ADC and NetScaler Gateway
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedInstall the updated version · Segment the appliance
What it allows
An attacker with no account can run their own code on the appliance. In the case CISA describes, the actors dropped a webshell, a small hidden tool that gives remote control, then explored the victim's Active Directory and took data from it.
Who is affected
Per the vendor, only when the appliance is set up as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. Affected: 13.1 before 13.1-49.13, 13.0 before 13.0-91.13, 13.1-FIPS before 13.1-37.159, and 12.1-FIPS and 12.1-NDcPP before 12.1-55.297. Version 12.1 is end of life and vulnerable. The bulletin covers customer-managed products only.
The vendor published its bulletin on 18 July 2023 and said exploits on unmitigated appliances had been observed. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 19 July 2023. The KEV entry flags known use in ransomware campaigns.
CISA advisory AA23-201A (20 July 2023, updated 6 September 2023) says that in June 2023 threat actors used the flaw as a zero-day against a critical infrastructure organization's non-production appliance. They tried to reach a domain controller, but network segmentation around the appliance blocked them. The victim reported the activity to CISA and the vendor.
Who exploits it
- Threat group MirrorFace Attributed by Japan's National Police Agency (NPA) and NISC (8 January 2025) as an organized group with suspected Chinese involvement, MirrorFace (also called Earth Kasha) is reported to target Japanese think tanks, government, politicians, media, academia, and semiconductor, manufacturing and aerospace firms. Since 2019
- Ransomware group RansomHub RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service
What to do
-
Install the updated version
CISA says to install the relevant updated NetScaler ADC and Gateway version as soon as possible. The vendor names 13.1-49.13, 13.0-91.13, 13.1-FIPS 13.1-37.159 and 12.1-FIPS or NDcPP 12.1-55.297, or later.
-
Replace end-of-life 12.1 appliances
The vendor states version 12.1 is end of life and vulnerable, so move to a supported version.
-
Segment the appliance
In the case CISA describes, network segmentation stopped the actors reaching a domain controller. Keep these devices apart from core systems.
-
Check for compromise
CISA encourages critical infrastructure organizations to use the detection guidance in AA23-201A to decide whether a device was compromised.
-
Require phishing-resistant MFA
CISA recommends phishing-resistant multifactor authentication for all staff and all services.
Questions
What is CVE-2023-3519?
It is a code injection flaw in NetScaler ADC and Gateway that lets an unauthenticated outsider run code on the appliance. It affects appliances set up as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server.
Was CVE-2023-3519 exploited in the wild?
Yes. CISA advisory AA23-201A says threat actors used it as a zero-day in June 2023 against a critical infrastructure organization. CISA added it to its Known Exploited Vulnerabilities catalog on 19 July 2023.
How do I fix CVE-2023-3519?
Install the updated NetScaler version the vendor names, such as 13.1-49.13 or 13.0-91.13, or later. Version 12.1 is end of life and vulnerable, so move to a supported version. Keep the appliance segmented from core systems.
What did the attackers do after getting in?
In the case CISA describes, the actors dropped a webshell, then explored the victim's Active Directory and took data from it. Network segmentation stopped them reaching a domain controller.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.