CVE-2022-27518: Critical RCE in Citrix ADC & Citrix Gateway Being Exploited in the Wild

Category: Vulnerability Intelligence	Vulnerability Class: Remote Code Execution	CVE ID: CVE-2022-27518	CVSS:3.0 Score: 9.8

Executive Summary

THREAT	IMPACT	MITIGATION
Critical RCE vulnerability affecting Citrix ADC and Citrix Gateway. APT 5 has been observed exploiting this vulnerability in the wild as per Citrix and NSA. Threat actors on the cybercrime forums were looking to buy the exploits for this vulnerability to perform arbitrary code execution.	Threat actors can exploit the vulnerabilities to Gain initial access Disclose sensitive information Perform DDoS attacks Encrypt the infrastructure with malware Gain privileges and execute arbitrary code remotely	Update to the latest versions: Citrix ADC and Citrix Gateway 13.0-58.32 and later releases of 13.0 Citrix ADC and Citrix Gateway 12.1-65.25 and later releases of 12.1 Citrix ADC 12.1-FIPS 12.1-55.291 and later releases of 12.1-FIPS Citrix ADC 12.1-NDcPP 12.1-55.291 and later releases of 12.1-NDcPP

Analysis

CVE-2022-27518 is a critical and high-severity vulnerability, with a CVSS:3.0 score of 9.8, affecting Citrix ADC and Citrix Gateway that was disclosed on 13 December 2022 by Citrix. It allows an unauthenticated remote attacker to perform arbitrary code execution on a vulnerable appliance.

Citrix and NSA mentioned that they have observed exploitation attempts in the wild, which have been attributed to APT 5. Several other cyber criminals have also shown interest in buying exploits for the vulnerability.

As of now, there is no publicly available exploit. However, this scenario is expected to change as soon as a viable exploit is created and shared publicly.

 

Affected Products

The following table lists the Citrix products and their versions affected by this vulnerability.

SNo.	Product Name	Affected Versions	Updated versions
1.	Citrix ADC and Citrix Gateway	13.0 before 13.0-58.32	13.0-58.32 and later releases of 13.0
2.	Citrix ADC and Citrix Gateway	12.1 before 12.1-65.25	12.1-65.25 and later releases of 12.1
3.	Citrix ADC 12.1-FIPS	before 12.1-55.291	12.1-55.291 and later releases of 12.1-FIPS
4.	Citrix ADC 12.1-NDcPP	before 12.1-55.291	12.1-55.291 and later releases of 12.1-NDcPP

Pre-Conditions

• Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP
• To check if the Citrix ADC or Citrix Gateway is configured as above, inspect ns.conf file by running the following command:
  • SAML SP
  • SAML IdP

Information from OSINT

The NSA has issued an advisory warning about a critical vulnerability affecting Citrix ADC and Citrix Gateway. According to the NSA and Citrix, APT5 – a Chinese state-backed threat actor known to target telecommunications and technology companies, is actively exploiting this vulnerability.

Shodan searches suggest that Citrix Gateway is used by a large number of organizations worldwide.

 

Indicators of Compromise (IoCs)

Based on the results from VirusTotal, the following are the IOCs for APT5.

Hashes
ed0c77d57643f07a19430c5671a21c0c77cd7439ac2cd912887f141c6fe41d4a
074c472406e38385fe769fbaaa72c7259247f42ef1b9140f31228afc66afbc67
0f5b183bbf24a075450be4d603de2a02d7cc0e2eef9942c540ae1503b0c38b1d
Names
vti-rescan	x.exe
mgc.exe	netmgr.exe
Hostname
tsl.gettrials.com

References

• ^#Traffic Light Protocol – Wikipedia
• Overview of APT5
• Citrix Update on CVE-2022-27518
• NSA Warning Advisory for CVE-2022-27518

Appendix