Last week, Citrix released patches for a total of 11 vulnerabilities in some of its most popular products , including Citrix ADC. However, according to new research, malicious actors are constantly trying to exploit Citrix ADC vulnerabilities
One of the vulnerabilities discovered in December 2019 in Citrix ADC devices was rated high severity, as it allowed remote code by attackers.
The vulnerabilities are found in various Citrix products and range from low to high severity, such as code injection and cross-site scripting flaws.
However, Citrix includes several factors that can mitigate the exploitation of these flaws by hackers.
Total number of vulnerabilities
Affected products
In total, there are 11 Citrix ADC products affected by the vulnerabilities:
- Citrix ADC, Citrix Gateway - Information disclosure
- Citrix ADC, Citrix Gateway 12.0 and 11.1 only-Denial of service
- Citrix ADC, Citrix Gateway-Local elevation of privileges
- Citrix ADC, Citrix Gateway, Citrix SDWAN WANOP-Reflected Cross-Site Scripting (XSS)
- Citrix ADC, Citrix Gateway, Citrix SDWAN WANOP-Authorization bypass
- Citrix ADC, Citrix Gateway, Citrix SDWAN WANOP-Code Injection
- Citrix ADC, Citrix Gateway, Citrix SDWAN WANOP-Information disclosure
- Citrix ADC, Citrix Gateway, Citrix SDWAN WANOP-Information disclosure
- Citrix ADC, Citrix Gateway-Elevation of privileges
- Citrix ADC, Citrix Gateway, Citrix SDWAN WANOP-Stored Cross-Site Scripting (XSS)
- Citrix Gateway Plug-in for Linux-Local elevation of privileges
Apart from that, there are a total of 16 IP addresses affected by the vulnerabilities and all of these IPs belong to “hostwindsdns{.}Com“:
- 23.254.164.181
- 23.254.164.48
- 43.245.160.163
- 104.168.166.234
- 104.168.194.148
- 142.11.213.254
- 142.11.227.204
- 192.119.73.107
- 192.119.73.108
- 192.236.162.232
- 192.236.163.117
- 192.236.163.119
- 192.236.192.119
- 192.236.192.3
- 192.236.192.5
- 192.236.192.6
Citrix advises customers to pay close attention to the alerts it just released. The fixes are available here.
