Security researchers have reported that threat actors are actively exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances. The exploitation activity, identified across multiple customer environments, involves deploying web shells, creating a superuser account, and mapping web shells to CSS-like URLs to conceal malicious files. Additionally, actors are attempting to exfiltrate configuration data from compromised systems. The findings were analyzed by LevelBlue's Threat Hunt Operations & Research (THOR) team.

Which products are affected?

NetScaler ADC, NetScaler Gateway

What should defenders do?

Apply the latest Citrix firmware and security patches immediately. Follow CISA Binding Operational Directives and vendor hardening guides. Restrict network access to NetScaler management interfaces. Monitor for unauthorized superuser accounts and unusual CSS file references in web server logs.

criticalcyber attacks

Citrix NetScaler Pre-Authentication Vulnerability Exploited to Deploy Web Shells and Create Superuser Accounts

Threat actors leveraging a critical command injection flaw to gain persistent, unauthenticated access to NetScaler ADC and Gateway appliances

CyberIntel DeskPublished about 1 hour agoUpdated less than a minute ago1 min read

Citrix NetScaler Pre-Authentication Vulnerability Exploited to Deploy Web Shells and Create Superuser Accounts

Key Takeaways

Threat actors are actively exploiting a pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway.
The exploitation results in web shell deployment, superuser creation, and mapping of malicious files to CSS-like URLs for stealth.
Actors are attempting to exfiltrate configuration data from compromised appliances.

Related Security News

highCyber Attacks

Cisco Talos Identifies Antino Backdoor Leveraging Outlook and OneDrive in China-Nexus Espionage Campaign

Cisco Talos has uncovered a new cyberespionage campaign attributed to a China-nexus threat actor. The operation deploys a previously undocumented backdoor codenamed Antino, which specifically targets government and policy organizations across Asia. The backout leverages legitimate Microsoft services, including Outlook and OneDrive, for command and control communication, making detection more difficult. Victims have been identified in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar.

The Hacker News22 minutes ago2 min read