[BreachExchange] Citrix vulnerability allowed criminals to hack 80, 000 companies

[Destry Winant]

https://www.itproportal.com/news/citrix-vulnerability-allows-criminals-to-hack-80000-companies/

Researchers have found a vulnerability in popular enterprise software
offerings from Citrix which puts tens of thousands of companies at
risk of cyberattack.

Mikhail Klyuchnikov, cybersecurity expert at Positive Technologies,
says he uncovered a critical vulnerability in Citrix Application
Delivery Controller (NetScaler ADC) and Citrix Gateway (NetScaler
Gateway), which allows direct access to a company network from the
internet.

No accounts necessary, anyone can do it.

According to Positive Technologies’ report on the flaw, around 80,000
companies in 158 countries around the world could be at risk. Most
companies are located in the US, with the UK, Germany, the Netherlands
and Australia sharing a significant portion.

The discovered vulnerability was assigned identifier CVE-2019-19781
and even though the CVSS severity level has not yet been determined,
Positive Technologies expect the highest level, 10, to be given. This
vulnerability affects all supported versions of the product, and all
supported platforms, including Citrix ADC and Citrix Gateway 13.0,
Citrix ADC and NetScaler Gateway 12.1, Citrix ADC and NetScaler
Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1, and also Citrix
NetScaler ADC and NetScaler Gateway 10.5.

The attacker could access published applications and attack other
resources directly from the Citrix server. Citrix released a set of
measures, saying it’s paramount that all vulnerable versions get
updated immediately.

"Citrix applications are widely used in corporate networks. This
includes their use for providing terminal access of employees to
internal company applications from any device via the Internet.
Considering the high risk brought by the discovered vulnerability, and
how widespread Citrix software is in the business community, we
recommend information security professionals take immediate steps to
mitigate the threat," says Dmitry Serebryannikov, Director of Security
Audit Department, Positive Technologies.

Serebryannikov praised Citrix’s fast response to the matter: "On a
separate note, we want to point out that the vendor responded very
promptly, by creating and releasing a set of risk mitigation measures
within just a couple of weeks after the vulnerability was discovered.
>From our experience, we know that in many cases it can take months."