Citrix NetScaler ADC / Gateway CVE-2023-3519 (unauthenticated remote code execution, exploited as a zero-day, CISA KEV): which builds are fixed and what do I do if an appliance was exposed?

What it is: CVE-2023-3519 is a code-injection flaw in Citrix (now NetScaler) ADC and Gateway that allows unauthenticated remote code execution. Citrix released fixes on July 18, 2023. CISA reports that in June 2023 attackers used it as a zero-day to drop a web shell on a critical-infrastructure organization's NetScaler ADC, then performed Active Directory discovery and tried to move laterally. It is in the CISA KEV catalog (added 2023-07-19) with known ransomware use, and exposed appliances continued to be mass-compromised afterwards. Am I affected: NVD's data for the vendor advisory lists these as vulnerable, i.e. anything older than the first fixed build in the same branch: - NetScaler ADC and Gateway 13.1 before 13.1-49.13 - NetScaler ADC and Gateway 13.0 before 13.0-91.13 - NetScaler ADC 12.1 before 12.1-55.297 - A separate 13.1 build line fixed in 13.1-37.159 Check your build with the version shown in the GUI or by running show version on the appliance. Read the Citrix bulletin for the exact appliance configurations that are exposed, and treat any appliance that handles external traffic as in scope. Fix: 1. Upgrade to the fixed build for your branch or newer. Citrix and NetScaler have also released later builds for other critical bugs, so the safest target is the current recommended build for your branch. 2. There is no configuration change that replaces the update. Until patched, remove management and gateway services from the internet where possible. 3. If the appliance was unpatched while internet-facing, do not trust it. Follow CISA's advisory AA23-201A: quarantine or take the appliance offline, review it for web shells and persistence (for example modified startup scripts), review unusual authentications and outbound connections, and check whether the appliance can reach domain controllers. Reimage rather than clean in place, rebuild configuration from a trusted source, and provision new credentials, including LDAP/AD service accounts, certificates and private keys, and any secrets stored on the device. Report compromise to CISA. 4. Segment the appliance from internal networks so a compromise cannot easily pivot, as the network segmentation did in the incident CISA describes. Verify: show version reports a fixed build on every node (HA pair members and cluster nodes included), and a review of the file system and configuration against a known-good baseline finds no unexpected files. Sources: https://nvd.nist.gov/vuln/detail/CVE-2023-3519 https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a https://www.cisa.gov/known-exploited-vulnerabilities-catalog