PT-2023-3575 · Citrix · Citrix Netscaler Gateway+2

Published 2023-07-18 · Updated 2026-06-15 · CVE-2023-3519

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Citrix NetScaler ADC (affected versions not specified) Citrix NetScaler Gateway (affected versions not specified)

Description An issue in Citrix NetScaler ADC and NetScaler Gateway involves incorrect code generation management, leading to unauthenticated remote code execution. This allows a remote attacker to execute arbitrary code on the affected systems. Real-world exploitation has been observed, including the INC ransomware group targeting healthcare networks in Oceania using spear-phishing and credential dumping for lateral movement. Additionally, mass exploitation campaigns have resulted in the placement of PHP webshells on approximately 1,952 devices to maintain persistent access, even after systems were patched or rebooted. It is estimated that 6.3% of all active NetScaler instances were compromised during these campaigns, with over 5,500 instances remaining vulnerable at one point of analysis.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-03796

CVE-2023-3519

Affected Products

Citrix Adc

Citrix Netscaler Adc

Citrix Netscaler Gateway

References · 363

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_formssso_target_rce.rb · Exploit
• 🔥 https://github.com/BishopFox/CVE-2023-3519 · Exploit
• 🔥 https://github.com/securekomodo/citrixInspector · Exploit
• 🔥 https://github.com/mandiant/citrix-ioc-scanner-cve-2023-3519 · Exploit
• 🔥 https://github.com/telekom-security/cve-2023-3519-citrix-scanner · Exploit
• 🔥 https://github.com/mr-r3b00t/CVE-2023-3519 · Exploit
• 🔥 https://github.com/SalehLardhi/CVE-2023-3519 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-3519 · Exploit
• 🔥 https://github.com/Mohammaddvd/CVE-2023-3519 · Exploit
• 🔥 https://github.com/rwincey/cve-2023-3519 · Exploit
• 🔥❌ https://github.com/dorkerdevil/CitrixFall · Exploit, Deleted
• 🔥 http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2023-3519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3519 · Security Note
• https://bdu.fstec.ru/vul/2023-03796 · Security Note