Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells

SUMMARY

The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this Cybersecurity Advisory to warn network defenders about exploitation of CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. In June 2023, threat actors exploited this vulnerability as a zero-day to drop a webshell on a critical infrastructure organization’s non-production environment NetScaler ADC appliance. The webshell enabled the actors to perform discovery on the victim’s active directory (AD) and collect …

adc advisory agency application application delivery application delivery controller cisa citrix code code execution cve cybersecurity cybersecurity advisory defenders delivery exploitation exploited exploiting gateway infrastructure infrastructure security june june 2023 netscaler network network defenders rce remote code remote code execution security threat threat actors vulnerability webshells zero-day