{ "file_item": { "filepath": "security-advisories", "filename": "CERT-EU-SA2022-087.pdf" }, "title": "Critical Vulnerability in Citrix Gateway and Citrix ADC", "serial_number": "2022-087", "publish_date": "13-12-2022 15:50:00", "description": "On December 13, 2022, Citrix released a Security Bulletin regarding a critical vulnerability CVE-2022-27518 affecting its Citrix Gateway and Citrix ADC products. If exploited, this vulnerability can enable an unauthenticated remote attacker to perform arbitrary code execution on the appliance. According to NSA, the vulnerability is being exploited by APT5 group. APT5 is also known to have exploited Pulse Secure VPN vulnerabilities in 2021. It is then highly recommended to install the last security updates.", "url_title": "2022-087", "content_markdown": "---\ntitle: 'Critical Vulnerability in\u00a0Citrix\u00a0Gateway\u00a0and\u00a0Citrix\u00a0ADC'\nversion: '1.0'\nnumber: '2022-087'\noriginal_date: 'December 13, 2022'\ndate: 'December 13, 2022'\n---\n\n_History:_\n\n* _13/12/2022 --- v1.0 -- Initial publication_\n \n# Summary\n\nOn December 13, 2022, Citrix released a Security Bulletin regarding a critical vulnerability CVE-2022-27518 affecting its Citrix Gateway and Citrix ADC products [1]. If exploited, this vulnerability can enable an unauthenticated remote attacker to perform arbitrary code execution on the appliance.\n\nAccording to NSA, the vulnerability is being exploited by APT5 group [2, 3]. APT5 is also known to have exploited Pulse Secure VPN vulnerabilities in 2021. It is then highly recommended to install the last security updates.\n\n# Technical Details\n\nThis zero day vulnerability `CVE-2022-27518` is due to improper control of a resource through its lifetime. This vulnerability is exploitable only if Citrix ADC or Citrix Gateway is configured as a SAML SP or a SAML IdP.\n\n# Affected Products\n\nThe following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability: \n\n- Citrix ADC and Citrix Gateway 13.0 before 13.0-58.32 \n- Citrix ADC and\u202fCitrix\u202fGateway\u202f12.1\u202fbefore\u202f12.1-65.25 \n- Citrix ADC 12.1-FIPS before 12.1-55.291 \n- Citrix ADC 12.1-NDcPP before 12.1-55.291 \n\nCitrix ADC and Citrix Gateway version 13.1 is unaffected. Moreover for Citrix-managed cloud services or Citrix-managed Adaptive Authentication there is not need to take any action.\n\nFor identifying if Citrix ADC or Citrix Gateway is configured as a SAML SP or a SAML IdP, you need to inspect the `ns.conf` file for the following commands: \n\n- `add authentication samlAction` - Appliance is configured as a SAML SP or,\n- `add authentication samlIdPProfile` - Appliance is configured as a SAML IdP \n\nIf either of the commands are present in the `ns.conf` file and if the version is an affected version, then the appliance must be updated. \n\n# Recommendations\n\nCERT-EU highly recommends installing the latest updated versions of Citrix ADC or Citrix Gateway as soon as possible:\n\n- Citrix ADC and Citrix Gateway 13.0-58.32 and later releases \n- Citrix ADC\u202fand Citrix Gateway\u202f12.1-65.25 and later releases of 12.1 \n- Citrix ADC 12.1-FIPS 12.1-55.291 and later releases of 12.1-FIPS\u202f \n- Citrix ADC 12.1-NDcPP 12.1-55.291 and later releases of 12.1-NDcPP \n\nPlease note that Citrix ADC and Citrix Gateway versions prior to 12.1 are EOL and customers on those versions are recommended to upgrade to one of the supported versions. \n\n## Detection\n\nPlease consider using the NSA APT5: Citrix ADC Threat Hunting Guidance [3] to verify possible compromise.\n\n# References\n\n[1] \n\n[2] \n\n[3] \n", "content_html": "

History:

  • 13/12/2022 --- v1.0 -- Initial publication

Summary

On December 13, 2022, Citrix released a Security Bulletin regarding a critical vulnerability CVE-2022-27518 affecting its Citrix Gateway and Citrix ADC products [1]. If exploited, this vulnerability can enable an unauthenticated remote attacker to perform arbitrary code execution on the appliance.

According to NSA, the vulnerability is being exploited by APT5 group [2, 3]. APT5 is also known to have exploited Pulse Secure VPN vulnerabilities in 2021. It is then highly recommended to install the last security updates.

Technical Details

This zero day vulnerability CVE-2022-27518 is due to improper control of a resource through its lifetime. This vulnerability is exploitable only if Citrix ADC or Citrix Gateway is configured as a SAML SP or a SAML IdP.

Affected Products

The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability:

  • Citrix ADC and Citrix Gateway 13.0 before 13.0-58.32
  • Citrix ADC and\u202fCitrix\u202fGateway\u202f12.1\u202fbefore\u202f12.1-65.25
  • Citrix ADC 12.1-FIPS before 12.1-55.291
  • Citrix ADC 12.1-NDcPP before 12.1-55.291

Citrix ADC and Citrix Gateway version 13.1 is unaffected. Moreover for Citrix-managed cloud services or Citrix-managed Adaptive Authentication there is not need to take any action.

For identifying if Citrix ADC or Citrix Gateway is configured as a SAML SP or a SAML IdP, you need to inspect the ns.conf file for the following commands:

  • add authentication samlAction - Appliance is configured as a SAML SP or,
  • add authentication samlIdPProfile - Appliance is configured as a SAML IdP

If either of the commands are present in the ns.conf file and if the version is an affected version, then the appliance must be updated.

Recommendations

CERT-EU highly recommends installing the latest updated versions of Citrix ADC or Citrix Gateway as soon as possible:

  • Citrix ADC and Citrix Gateway 13.0-58.32 and later releases
  • Citrix ADC\u202fand Citrix Gateway\u202f12.1-65.25 and later releases of 12.1
  • Citrix ADC 12.1-FIPS 12.1-55.291 and later releases of 12.1-FIPS\u202f
  • Citrix ADC 12.1-NDcPP 12.1-55.291 and later releases of 12.1-NDcPP

Please note that Citrix ADC and Citrix Gateway versions prior to 12.1 are EOL and customers on those versions are recommended to upgrade to one of the supported versions.

Detection

Please consider using the NSA APT5: Citrix ADC Threat Hunting Guidance [3] to verify possible compromise.

References

[1] https://support.citrix.com/article/CTX474995/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202227518

[2] https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-citrix-adc-and-gateway-zero-day-patch-now/

[3] https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF

", "licence": { "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)", "link": "https://creativecommons.org/licenses/by/4.0/", "restrictions": "https://cert.europa.eu/legal-notice", "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies" } }