CVE-2022-27518
Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability
Description
CVE-2022-27518 is a critical remote code execution vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway. An unauthenticated remote attacker can exploit this flaw to execute arbitrary code on the affected appliance without requiring any credentials or user interaction. With a CVSS score of 9.8 (Critical) and confirmed active exploitation in the wild, CVE-2022-27518 was added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of January 3, 2023. The EPSS score of 0.23 (95th percentile) reflects a high probability of exploitation, consistent with the targeting of Citrix ADC devices by advanced threat actors.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | application delivery controller firmware | >= 12.1, < 12.1-55.291; >= 12.1, < 12.1-65.25; >= 13.0, < 13.0-58.32 |
| citrix | gateway firmware | >= 12.1, < 12.1-65.25; >= 13.0, < 13.0-58.32 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://support.citrix.com/article/CTX474995(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27518(US Government Resource)
Weakness Type
CWE-664: Improper Control of a Resource Through its Lifetime
CWE-664 describes weaknesses related to improper management of a resource throughout its creation, use, and release. In the case of CVE-2022-27518, the Citrix ADC and Gateway firmware fails to properly control resource handling during certain operations, which an attacker can leverage to execute arbitrary code remotely. This broad weakness category encompasses issues with initialization, allocation, and lifetime management of internal objects.
Learn more: CWE-664 — Improper Control of a Resource Through its Lifetime
Impact Analysis
Confidentiality Impact: High — exploitation of CVE-2022-27518 can provide an attacker with full access to sensitive data processed by the Citrix ADC or Gateway appliance, including VPN session tokens, authentication credentials, TLS private keys, and internal network traffic. Integrity Impact: High — arbitrary code execution enables attackers to modify device configurations, install persistent backdoors, alter load balancing rules, or inject malicious content into web traffic passing through the appliance. Availability Impact: High — an attacker can crash the appliance, disrupt VPN access for all remote users, or render web applications behind the ADC unavailable. Scope: The vulnerability is contained within the Citrix appliance context (Scope Unchanged), but as a perimeter network device, compromise provides a strategic vantage point for attacking internal systems. Attack Prerequisites: CVE-2022-27518 requires no authentication and no user interaction. The attack is network-based with low complexity, meaning any attacker with access to the Citrix ADC or Gateway management or virtual server interface can exploit it. Since these appliances are typically internet-facing, the attack surface is significant.
Exploit Maturity
Active Exploitation: CVE-2022-27518 has been confirmed as actively exploited in the wild. The U.S. National Security Agency (NSA) issued a joint advisory warning that a state-sponsored threat actor was leveraging this vulnerability to target Citrix ADC appliances. KEV Catalog Status: CISA added CVE-2022-27518 to its Known Exploited Vulnerabilities catalog with a remediation deadline of January 3, 2023, reflecting the critical urgency. EPSS Score: The EPSS score of 0.23 (95th percentile) indicates a high likelihood of exploitation, ranking it among the most likely-to-be-exploited vulnerabilities tracked. Ransomware Association: There is currently no confirmed association between CVE-2022-27518 and ransomware campaigns, though its use by advanced persistent threat actors for network intrusion suggests it could be leveraged as an initial access vector for various malicious objectives. Threat Actor Attribution: The NSA attributed exploitation of CVE-2022-27518 to APT5, a threat group with a focus on telecommunications and technology sector targets.
Remediation
- Immediately upgrade Citrix ADC and Citrix Gateway to a patched firmware version as specified in Citrix advisory CTX474995.
- Prioritize patching for any Citrix ADC or Gateway appliances configured as SAML Service Providers or SAML Identity Providers, as these configurations are required for exploitation.
- If immediate patching is not possible, restrict network access to the Citrix ADC or Gateway appliance to trusted IP ranges only and monitor for anomalous activity.
- Review appliance logs and file system integrity for signs of compromise, including unauthorized configuration changes, unexpected processes, or web shell installations.
- Consult Citrix's security advisory at https://support.citrix.com/article/CTX474995 for the full list of affected versions and specific upgrade paths.
- Implement network segmentation to isolate the Citrix ADC from critical internal systems and limit the potential for lateral movement if the appliance is compromised.
- Ensure compliance with CISA's remediation deadline if your organization is subject to Binding Operational Directive 22-01.
Technical Details
Vulnerability Mechanism: CVE-2022-27518 is an unauthenticated remote code execution vulnerability in Citrix ADC and Citrix Gateway. The flaw is classified under CWE-664 (Improper Control of a Resource Through its Lifetime), indicating a deficiency in how the appliance manages internal resources during specific operations. The exact technical root cause involves improper handling of request processing that allows an attacker to corrupt memory or internal state and divert execution flow. CVSS Vector Analysis: The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with a score of 9.8 represents the most severe attack profile: network-accessible with low complexity, requiring neither authentication nor user interaction. The maximum impact ratings across confidentiality, integrity, and availability confirm that successful exploitation yields complete control of the appliance. Exploitation Prerequisites: The vulnerability specifically affects Citrix ADC and Gateway appliances configured as a SAML Service Provider (SP) or a SAML Identity Provider (IdP). Appliances that do not have SAML configured are not exploitable through this vulnerability. Affected Products: Citrix ADC and Citrix Gateway firmware across multiple version branches are affected. Organizations should consult CTX474995 for the full version matrix. Threat Context: The NSA and CISA jointly disclosed that APT5 actively exploited this vulnerability to compromise Citrix ADC appliances. The threat actor deployed web shells and other tools to establish persistent access, exfiltrate data, and move laterally within victim networks. The targeting of SAML-enabled appliances suggests the attacker's goal included intercepting or forging authentication tokens.
Frequently Asked Questions
What is CVE-2022-27518?
CVE-2022-27518 is a critical unauthenticated remote code execution vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway. It allows an attacker to execute arbitrary code on the appliance without any credentials.
How critical is CVE-2022-27518?
With a CVSS score of 9.8 (Critical), this is among the most severe vulnerabilities possible. It was actively exploited by a state-sponsored threat actor (APT5) and requires no authentication or user interaction to exploit.
Which Citrix configurations are vulnerable?
Only Citrix ADC and Gateway appliances configured as a SAML Service Provider or SAML Identity Provider are vulnerable to CVE-2022-27518. Appliances without SAML configuration are not affected by this specific vulnerability.
Was CVE-2022-27518 exploited by nation-state actors?
Yes, the NSA issued a joint advisory attributing exploitation of CVE-2022-27518 to APT5, a sophisticated threat group known for targeting telecommunications and technology organizations.
How do I fix CVE-2022-27518?
Upgrade Citrix ADC and Gateway firmware to the latest patched version as specified in Citrix advisory CTX474995. If immediate patching is not feasible, restrict access to the appliance and monitor for indicators of compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.