1000’s of Citrix Software Supply Controller (ADC) and Gateway endpoints stay susceptible to 2 crucial safety flaws disclosed by the corporate over the previous couple of months.
The problems in query are CVE-2022-27510 and CVE-2022-27518 (CVSS scores: 9.8), which had been addressed by the virtualization providers supplier on November 8 and December 13, 2022, respectively.
Whereas CVE-2022-27510 pertains to an authentication bypass that might be exploited to achieve unauthorized entry to Gateway person capabilities, CVE-2022-27518 considerations a distant code execution bug that might allow the takeover of affected techniques.
Citrix and the U.S. Nationwide Safety Company (NSA), earlier this month, warned that CVE-2022-27518 is being actively exploited within the wild by menace actors, together with the China-linked APT5 state-sponsored group.
Now, in keeping with a new evaluation from NCC Group’s Fox-IT analysis workforce, hundreds of internet-facing Citrix servers are nonetheless unpatched, making them a lovely goal for hacking crews.
This contains over 3,500 Citrix ADC and Gateway servers working model 12.1-65.21 which might be vulnerable to CVE-2022-27518, in addition to greater than 500 servers working 12.1-63.22 which might be susceptible to each flaws.
A majority of the servers, amounting to a minimum of 5,000, are working 13.0-88.14, a model that is resistant to CVE-2022-27510 and CVE-2022-27518.
A rustic-wise breakdown reveals that greater than 40% of servers situated in Denmark, the Netherlands, Austria, Germany, France, Singapore, Australia, the U.Okay., and the U.S. have been up to date, with China faring the worst, the place solely 20% of practically 550 servers have been patched.
Fox-IT mentioned it was capable of deduce the model data from an MD5-like hash worth current within the HTTP response of login URL (i.e., “ns_gui/vpn/index.html”) and mapping it to their respective variations.
