CISA Mandates Urgent Patching for Citrix NetScaler Vulnerabilities

Rohan Timalsina

January 29, 2024 - TuxCare expert team

In a recent move to bolster cybersecurity defenses, CISA has issued a directive to U.S. federal agencies to urgently secure their systems against three newly patched vulnerabilities in Citrix NetScaler and Google Chrome. These vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities Catalog and are actively exploited by malicious actors, emphasizing the critical need for organizations to take immediate action.

The identified vulnerabilities include a code injection flaw (CVE-2023-6548) and a buffer overflow issue (CVE-2023-6549) in Citrix NetScaler ADC and Gateway appliances. These vulnerabilities can lead to remote code execution and denial-of-service attacks, posing significant risks to the security of federal enterprises. Additionally, a zero-day exploit (CVE-2024-0519) in the Chromium V8 JavaScript engine used by Google Chrome has been patched, marking the first Chrome zero-day addressed in the wild this year.

Citrix’s Urgent Call to Action

Citrix, the provider of the affected appliances, has issued an immediate call to its customers to patch Internet-exposed NetScaler ADC and Gateway devices promptly. The urgency is particularly emphasized for CVE-2023-6548 vulnerability, which impacts the management interfaces of Citrix NetScaler ADC and Gateway appliances. Affected users of NetScaler ADC and NetScaler Gateway are required to upgrade to the updated versions immediately. Citrix recommends that organizations unable to install the security updates immediately should employ a temporary workaround by blocking network traffic to affected instances and ensuring they are not accessible online. For more information, read the Citrix security bulletin.

As reported by the Shadowserver threat monitoring platform, over 51,000 Netscaler appliances are currently exposed online, with only 1,500 having their management interfaces accessible over the Internet.

Immediate Patching Required

CISA, through its Known Exploited Vulnerabilities Catalog, has mandated a specific timetable for addressing the identified vulnerabilities. For the Citrix NetScaler vulnerability (CVE-2023-6548), U.S. Federal Civilian Executive Branch Agencies are required to patch vulnerable devices within a week, by January 24. The other two vulnerabilities, CVE-2023-6549 and CVE-2024-0519, must be mitigated within three weeks by February 7.

While the directive specifically targets U.S. federal agencies, CISA strongly encourages all organizations, including private companies, to prioritize the patching of these security flaws. The urgency is evident in the expedited patch process for CVE-2023-6548, underlining the severity of the threat posed by the vulnerability affecting NetScaler management interfaces.

Conclusion

In the face of escalating cyber threats, the importance of timely patching and securing systems cannot be overstated. Organizations must heed CISA’s directive, prioritize the identified vulnerabilities, and take immediate action to safeguard their networks against potential exploitation. The evolving landscape of cyber threats necessitates a proactive approach to cybersecurity, and addressing Citrix NetScaler vulnerabilities is a crucial step in fortifying our digital defenses.

The sources for this article include a story from BleepingComputer.

Summary