CVE-2023-3519
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Description
CVE-2023-3519 is a critical code injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway that enables unauthenticated remote code execution. This vulnerability allows an attacker to execute arbitrary code on the affected Citrix appliance without any prior authentication or user interaction. CVE-2023-3519 affects Citrix NetScaler ADC and NetScaler Gateway, both widely deployed as network infrastructure components for load balancing, VPN access, and application delivery. CISA has confirmed active exploitation of this vulnerability in the wild and it has been associated with ransomware campaigns, making it an urgent security threat. With a CVSS score of 9.8 (Critical) and an EPSS score of 93.7%, CVE-2023-3519 represents one of the most dangerous Citrix vulnerabilities requiring immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler application delivery controller | >= 12.1, < 12.1-55.297; >= 13.0, < 13.0-91.13; >= 13.1, < 13.1-37.159; >= 13.1, < 13.1-49.13 |
| citrix | netscaler gateway | >= 13.0, < 13.0-91.13; >= 13.1, < 13.1-49.13 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-3519(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection vulnerabilities occur when an application allows untrusted input to be included in dynamically generated code, enabling an attacker to inject and execute arbitrary commands. In CVE-2023-3519, the Citrix NetScaler ADC and Gateway appliances fail to properly sanitize or control code generation, allowing a remote unauthenticated attacker to inject and execute arbitrary code on the target system.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2023-3519 is remotely exploitable without physical access, as the attack vector is network-based. The vulnerability is easy to exploit with no special conditions needed, requires no authentication, and demands no user interaction for successful exploitation. Confidentiality (High): An attacker can access all data processed by the NetScaler appliance, including authentication credentials, session tokens, and encrypted traffic. Integrity (High): Full code execution allows the attacker to modify system configurations, inject backdoors, and tamper with traffic passing through the appliance. Availability (High): The attacker can disrupt or completely disable the NetScaler appliance, affecting all dependent applications and VPN connectivity. With a CVSS score of 9.8 (Critical severity) and an EPSS score of 93.7%, this vulnerability is among the most severe Citrix security flaws. The confirmed association with ransomware campaigns underscores the real-world danger, as attackers are using this vulnerability as an entry point for deploying ransomware across enterprise networks.
Exploit Maturity
Public exploit code is available for CVE-2023-3519 via Packet Storm Security, providing attackers with a ready-made tool to exploit vulnerable Citrix NetScaler appliances. CISA has confirmed active exploitation in the wild and this vulnerability has been used in ransomware campaigns, significantly elevating the threat level. The EPSS score of 93.7% places it in the 99.8th percentile, indicating near-certain exploitation activity across the threat landscape. The Citrix security bulletin references CVE-2023-3519 alongside CVE-2023-3466 and CVE-2023-3467, suggesting these vulnerabilities may be chained together for maximum impact in attack campaigns.
Remediation
- Apply vendor patches immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Refer to the Citrix security bulletin CTX561482 for specific patch guidance.
- Upgrade Citrix NetScaler ADC and NetScaler Gateway to the latest patched firmware versions as specified in the Citrix advisory. Ensure all affected appliances — both ADC and Gateway deployments — are updated.
- Isolate unpatched NetScaler appliances from the network immediately. Implement strict network segmentation to limit access to management interfaces, and place affected appliances behind additional firewall rules that restrict inbound traffic to only essential ports and trusted IP ranges.
- Conduct thorough compromise assessment on all NetScaler appliances. Review system logs for indicators of compromise, check for web shells or unauthorized modifications to the filesystem, and scan for any backdoors that may have been planted during exploitation. CISA has published IOCs specific to this vulnerability.
- Implement ongoing monitoring for all NetScaler appliances, including intrusion detection signatures for CVE-2023-3519 exploitation attempts, and enforce strict input validation and code execution controls on the appliance infrastructure.
Technical Details
CVE-2023-3519 is a code injection vulnerability (CWE-94) in Citrix NetScaler ADC and NetScaler Gateway that allows unauthenticated remote code execution. The vulnerability exists because the appliance fails to properly control the generation and execution of code, enabling an attacker to inject malicious code through network-accessible interfaces. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the maximum exploitability characteristics: network-accessible, low attack complexity, no privileges required, and no user interaction needed, resulting in complete compromise of confidentiality, integrity, and availability. The scope remains unchanged, indicating the impact is contained to the NetScaler appliance itself, though in practice, compromising a network gateway device provides a strategic foothold for lateral movement into the broader enterprise environment.
Frequently Asked Questions
Is CVE-2023-3519 being actively exploited?
Yes, CVE-2023-3519 is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 9, 2023, and confirmed its use in ransomware campaigns. Public exploit code is available, making this vulnerability accessible to a wide range of threat actors.
What products are affected by CVE-2023-3519?
CVE-2023-3519 affects Citrix NetScaler ADC and Citrix NetScaler Gateway. All versions of these products prior to the patched releases documented in Citrix security bulletin CTX561482 are vulnerable. Both products are widely deployed as critical network infrastructure components.
How do I fix CVE-2023-3519?
Apply the firmware updates specified in Citrix security bulletin CTX561482 to all affected NetScaler ADC and NetScaler Gateway appliances immediately. Until patching is complete, isolate vulnerable appliances from the network and restrict access to management interfaces. Conduct a thorough compromise assessment to check for web shells or backdoors.
How severe is CVE-2023-3519?
CVE-2023-3519 is rated Critical with a CVSS score of 9.8 out of 10, the highest severity category. The EPSS score of 93.7% places it in the 99.8th percentile, and it has been confirmed in ransomware campaigns. This combination of critical severity, active exploitation, and ransomware association makes it one of the most dangerous vulnerabilities to address.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.