Citrix ADC / Gateway CVE-2019-19781 ('Shitrix' path traversal to unauthenticated RCE, CISA KEV, AA20-031A): how do I check an old appliance, patch it and hunt for compromise?

What it is: CVE-2019-19781, disclosed in December 2019, is a path traversal flaw in Citrix ADC (NetScaler ADC), Citrix Gateway and some SD-WAN WANOP appliances. An unauthenticated attacker could reach scripts that should require login and run code on the device. Exploitation became widespread in January 2020, including web shells, crypto miners and the NOTROBIN backdoor, and ransomware groups used it for initial access. It's in CISA's KEV catalog, and old appliances that missed the fix still show up. Am I affected: - NetScaler/Citrix ADC and Gateway builds before 10.5.70.12, 11.1.63.15, 12.0.63.13, 12.1.55.18 or 13.0.47.24, and SD-WAN WANOP 4000/4100/5000/5100 before 10.2.6b / 11.0.3b. Those release lines are all long out of support. - Check the build with show version on the CLI or in the GUI. Fix: 1. Move to a currently supported, patched ADC/Gateway release (today 14.1 or 13.1), which also covers later critical bugs such as CitrixBleed. Old 10.5-13.0 appliances should be upgraded or replaced. 2. If an old build must stay online briefly, the interim Citrix mitigation (CTX267679) blocked the vulnerable paths with a responder policy; it is a stopgap only. 3. Patching doesn't remove an existing compromise. Hunt using CISA AA20-031A: web logs (/var/log/httpaccess.log, httperror.log) for requests containing '/../vpns/' or to unexpected .pl scripts followed by .xml downloads; processes running as 'nobody'; the nobody user's crontab; unexpected files in /netscaler/portal/templates and /var/tmp/netscaler/portal/templates; a /tmp/.init directory (NOTROBIN); and unexpected outbound connections from the appliance. 4. If you find signs of compromise: rebuild from a clean image, rotate every credential stored on or passing through the device (LDAP bind accounts, certificates and keys, admin passwords), and check the internal network for follow-on activity. Verify: show version reports a supported, patched build, and the hunting checks above come back clean. Sources: https://support.citrix.com/article/CTX267027 https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-031a https://nvd.nist.gov/vuln/detail/CVE-2019-19781