CVE-2019-19781
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
Description
CVE-2019-19781 is a CRITICAL directory traversal vulnerability affecting Citrix Application Delivery Controller (ADC) and Gateway, carrying a CVSS 3.1 score of 9.8. This vulnerability allows unauthenticated remote attackers to perform arbitrary code execution through directory traversal attacks against the appliance's web interface. Affected products include Citrix ADC firmware (versions 10.5, 11.1, 12.0, 12.1, and 13.0), NetScaler Gateway firmware (versions 10.5 through 12.1), and Gateway firmware (13.0). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03 and is confirmed to be associated with ransomware campaigns. With an EPSS score of 0.94442 (99.99th percentile), this is one of the most actively exploited vulnerabilities ever cataloged and requires immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | application delivery controller firmware | 10.5; 11.1; 12.0; 12.1; 13.0 |
| citrix | netscaler gateway firmware | 10.5; 11.1; 12.0; 12.1 |
| citrix | gateway firmware | 13.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.html(Third Party Advisory, VDB Entry)
- https://badpackets.net/over-25000-citrix-netscaler-endpoints-vulnerable-to-cve-2019-19781/(Broken Link, Third Party Advisory)
- https://forms.gle/eDf3DXZAv96oosfj6(Third Party Advisory)
- https://support.citrix.com/article/CTX267027(Vendor Advisory)
- https://twitter.com/bad_packets/status/1215431625766424576(Broken Link, Third Party Advisory)
- https://www.kb.cert.org/vuls/id/619785(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19781(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2019-19781 is classified under CWE-22 — Improper Limitation of a Pathname to a Restricted Directory. Path traversal vulnerabilities occur when software uses external input to construct a pathname that should be within a restricted directory, but does not properly neutralize sequences such as "../" that can resolve to locations outside of that directory. This allows attackers to access files and directories stored outside the intended folder, potentially reading sensitive files, overwriting configurations, or executing arbitrary code.
In the context of Citrix ADC and Gateway, this path traversal weakness is catastrophically exploitable because it enables unauthenticated remote code execution. Attackers can traverse the directory structure to access and execute scripts beyond the intended web root, resulting in full system compromise. This vulnerability became one of the most widely exploited flaws in enterprise networking equipment history, with mass exploitation beginning shortly after public disclosure.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2019-19781 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker complete access to all data on the Citrix appliance, including VPN session information, cached credentials, configuration files, SSL certificates and private keys, and potentially data traversing the appliance from internal networks.
Integrity (HIGH): Attackers achieve full code execution on the appliance, enabling installation of backdoors, modification of system configurations, manipulation of VPN tunnels, injection of malicious content into proxied traffic, and lateral movement into internal networks.
Availability (HIGH): Complete disruption of the affected appliance is possible, including denial of service for all VPN users, disruption of load-balanced applications, and rendering the appliance inoperable through destructive payloads.
Scope Unchanged: While the CVSS scope is technically Unchanged, the practical impact extends far beyond the appliance itself because Citrix ADC and Gateway devices sit at the network perimeter and handle sensitive traffic between external users and internal resources.
With an EPSS score of 0.94442 (99.99th percentile), CVE-2019-19781 represents one of the highest exploitation probabilities of any tracked vulnerability.
Exploit Maturity
CVE-2019-19781 has extensive confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware association.
Exploit status: This is one of the most extensively exploited vulnerabilities in recent history. Multiple public exploits are available, including detailed proof-of-concept code on Packet Storm Security and GitHub. Exploitation was observed at massive scale beginning in January 2020, with over 25,000 vulnerable endpoints identified globally. Nation-state actors and criminal organizations actively exploited this vulnerability.
Ransomware association: CVE-2019-19781 is confirmed to be associated with ransomware campaigns. Multiple ransomware operators have used this vulnerability as an initial access vector, including operators deploying REvil/Sodinokibi, DoppelPaymer, Maze, and other ransomware families. The combination of unauthenticated RCE and the network-perimeter position of Citrix appliances makes this an ideal ransomware entry point.
Attack surface: Numerous public exploits exist with minimal exploitation complexity. Automated scanning tools and exploit frameworks have incorporated this vulnerability. Any internet-facing Citrix ADC or Gateway appliance running an unpatched version is at extreme risk.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Given the severity and active ransomware usage, immediate remediation is critical for all organizations.
Remediation
- Apply vendor patches immediately with highest priority. This vulnerability demands emergency patching. Update Citrix ADC and Gateway to the fixed versions specified in Citrix advisory CTX267027. Given the ransomware association, any delay increases the risk of catastrophic compromise.
- If patching is delayed, apply the Citrix mitigation immediately. Citrix published a mitigation configuration that can reduce risk while patches are being tested and deployed. However, this mitigation is not a substitute for patching and should only be used as a temporary measure.
- Assume compromise if the appliance was exposed while unpatched. If your Citrix appliance was internet-accessible during the vulnerability disclosure window (December 2019 onwards) without patches, conduct a thorough forensic investigation. Check for unauthorized modifications, backdoors, and signs of lateral movement.
- Scan for all affected instances. Identify every Citrix ADC (versions 10.5, 11.1, 12.0, 12.1, 13.0), Gateway, and NetScaler Gateway instance across your infrastructure. Verify firmware versions and patching status.
- Implement network monitoring and threat hunting. Deploy detection signatures for CVE-2019-19781 exploitation attempts. Monitor for unusual outbound connections, new cron jobs, modified scripts, and unauthorized file changes on Citrix appliances.
- Rotate all credentials accessible from the appliance. After patching and forensic review, rotate all passwords, certificates, and API keys that the Citrix appliance had access to, including VPN user credentials and backend service accounts.
Technical Details
CVE-2019-19781 is a CRITICAL-severity vulnerability in Citrix ADC and Gateway that can be exploited remotely over the network without any authentication or user interaction. The attack complexity is low, requiring no specialized conditions.
Technical mechanism: The vulnerability exists in the VPN handler of the Citrix ADC and Gateway web interface. By sending specially crafted HTTP requests containing directory traversal sequences (e.g., /../), an unauthenticated attacker can access Perl scripts and template files outside the intended web root. The attacker can then write arbitrary files to the appliance's filesystem via the vulnerable Perl scripts. By writing a crafted XML file to a location processed by a Newbash/cron mechanism, the attacker achieves arbitrary command execution as root.
Affected products and versions: Citrix ADC firmware (10.5, 11.1, 12.0, 12.1, 13.0), NetScaler Gateway firmware (10.5, 11.1, 12.0, 12.1), and Gateway firmware (13.0).
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the worst-case exploitation scenario: network-accessible, low complexity, no privileges required, no user interaction needed, with maximum impact across all three security dimensions. This combination of factors makes CVE-2019-19781 exceptionally dangerous.
Frequently Asked Questions
Is CVE-2019-19781 being actively exploited?
Yes, CVE-2019-19781 is one of the most actively and extensively exploited vulnerabilities in recent history. It is listed in CISA's KEV catalog with confirmed ransomware association. Mass exploitation began in January 2020 with over 25,000 vulnerable endpoints targeted globally. The EPSS score of 0.94442 (99.99th percentile) represents near-maximum exploitation probability. Multiple nation-state actors and ransomware operators have used this vulnerability.
What products are affected by CVE-2019-19781?
CVE-2019-19781 affects Citrix Application Delivery Controller (ADC) firmware versions 10.5, 11.1, 12.0, 12.1, and 13.0, NetScaler Gateway firmware versions 10.5 through 12.1, and Gateway firmware version 13.0. All organizations using these products should verify their patching status immediately. Consult Citrix advisory CTX267027 for the complete list of fixed versions.
How do I fix CVE-2019-19781?
Apply patches per Citrix advisory CTX267027 with the highest possible priority. If patching requires time, apply the Citrix-published mitigation configuration immediately as a temporary measure. Assume compromise if the appliance was exposed while unpatched, and conduct forensic analysis. After patching, rotate all credentials the appliance had access to.
How severe is CVE-2019-19781?
CVE-2019-19781 is rated CRITICAL with a maximum-impact CVSS 3.1 score of 9.8. It enables unauthenticated remote code execution on network perimeter devices. The EPSS score of 0.94442 (99.99th percentile) and confirmed ransomware association make this one of the most dangerous vulnerabilities tracked. It has been used by both nation-state and criminal threat actors for initial access to enterprise networks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.