A critical zero-day vulnerability has been confirmed to be actively exploited by state-backed attackers to gain access to corporate networks. The National Security Agency (NSA), a branch of the US Government, have released a cybersecurity advisory to help organisations detect and mitigate attacks that exploit this vulnerability. Products affected by this flaw are Citrix ADC and Citrix Gateway versions 13.0 before 13.0-58.32, and 12.1 before 12.2-65.25, as well as Citrix ADC 12.1-FIPS and Citrix ADC 12.1-NDcPP before 12.1-55.291. A security update was released by Citrix last week to patch this flaw, alongside a security blog post where Citrix warn admins to apply this patch as soon as possible, stating that customers with SAML SP or IdP configurations should “install the recommended builds immediately”.
The vulnerability tracked as CVE-2022-27518 is a critical severity zero-day flaw, with a CVSS base score of 9.8. An exploit of this vulnerability can allow for an unauthenticated attacker to remotely execute arbitrary code, however specific details about this vulnerability and how it has been exploited have not been released. This flaw occurs due to improper resource control in the affected systems if they are configured as SAML SP or SAML IdP. The attacks exploiting this vulnerability in the wild were found to be targeted attacks by state-sponsored APT5 hackers, also known as UNC2630 and MANGANESE.
There are no workarounds to mitigate this vulnerability, instead the official released patches should be applied as soon as possible to all affected appliances. Customers using Citrix-managed cloud services or Adaptive Authentication are not affected by this vulnerability, and no further action is required to be protected against these attacks. To update Citrix ADC and Citrix Gateway, follow the links to upgrade to version 13.1 which contain relevant downloads for this security patch. Citrix also warn customers that if an affected Citrix ADC or Gateway version is being run on an SDX platform, this will need to have VPX instances upgraded.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)