CVE-2019-19781criticalunder attackransomwareCWE-22

CVE-2019-19781

Published · Updated

Follow this CVE+ Monitor NetScaler Gateway+ Monitor NetScaler ADC

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 3 threat group(s) use it.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon14 days
Published on NVDDec 27
1st PoC+14d
metasploitDec 17
CISA KEV+677d
Who exploits it — 3

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT29🇷🇺 MITRE ATT&CK
APT / StateAPT41🇨🇳 MITRE ATT&CK
APT / StateDragonfly🇷🇺 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Citrix ADC and Gateway versions 10.5 through 13.0 contain a directory traversal vulnerability that allows attackers to access files and directories outside their intended location on the server, potentially exposing sensitive system information and configurations.

Technical detail

A path traversal vulnerability in Citrix ADC/Gateway enables unauthenticated remote attackers to bypass access controls and read arbitrary files on the affected system by manipulating file paths with directory traversal sequences (e.g., ../). The vulnerability affects multiple versions and can lead to unauthorized disclosure of sensitive data including credentials and system configuration.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 85
exploitdbwww.exploit-db.com/exploits/47901unverifiedexploitdbwww.exploit-db.com/exploits/47930unverifiedexploitdbwww.exploit-db.com/exploits/47913unverifiedgithubgithub.com/trustedsec/cve-2019-19781★ 573githubgithub.com/projectzeroindia/CVE-2019-19781★ 369githubgithub.com/mpgn/CVE-2019-19781★ 157githubgithub.com/MalwareTech/CitrixHoneypot★ 120githubgithub.com/cisagov/check-cve-2019-19781★ 110githubgithub.com/mandiant/ioc-scanner-CVE-2019-19781★ 94githubgithub.com/jas502n/CVE-2019-19781★ 85githubgithub.com/citrix/ioc-scanner-CVE-2019-19781★ 59githubgithub.com/aqhmal/CVE-2019-19781★ 11githubgithub.com/w4fz5uck5/CVE-2019-19781-CitrixRCE★ 10githubgithub.com/ianxtianxt/CVE-2019-19781★ 7githubgithub.com/VladRico/CVE-2019-19781★ 7githubgithub.com/unknowndevice64/Exploits_CVE-2019-19781★ 4githubgithub.com/onSec-fr/CVE-2019-19781-Forensic★ 3githubgithub.com/j81blog/ADC-19781★ 3githubgithub.com/k-fire/CVE-2019-19781-exploit★ 3githubgithub.com/andripwn/CVE-2019-19781★ 2githubgithub.com/oways/CVE-2019-19781★ 2githubgithub.com/DanielWep/CVE-NetScalerFileSystemCheck★ 2githubgithub.com/redscan/CVE-2019-19781★ 1githubgithub.com/Vulnmachines/Ctirix_RCE-CVE-2019-19781★ 1githubgithub.com/nmanzi/webcvescanner★ 1githubgithub.com/r4ulcl/CVE-2019-19781★ 1githubgithub.com/jamesjguthrie/Shitrix-CVE-2019-19781★ 0githubgithub.com/yukar1z0e/CVE-2019-19781★ 0githubgithub.com/pwn3z/CVE-2019-19781-Citrix★ 0githubgithub.com/autocode07/cisagov__check-cve-2019-19781.4142e02b★ 0githubgithub.com/EliusHHimel/citrix-honeypot★ 0githubgithub.com/qiong-qi/CVE-2019-19781-poc★ 0githubgithub.com/mekhalleh/citrix_dir_traversal_rce★ 0githubgithub.com/zgelici/CVE-2019-19781-Checker★ 0githubgithub.com/digitalshadows/CVE-2019-19781_IOCs★ 0githubgithub.com/SharpHack/CVE-2019-19781★ 0githubgithub.com/Roshi99/Remote-Code-Execution-Exploit-for-Citrix-Application-Delivery-Controller-and-Citrix-Gateway-CVE-201★ 0githubgithub.com/darren646/CVE-2019-19781POC★ 0githubgithub.com/digitalgangst/massCitrix★ 0githubgithub.com/L4r1k/CitrixNetscalerAnalysis★ 0githubgithub.com/Azeemering/CVE-2019-19781-DFIR-Notes★ 0githubgithub.com/0xams/citrixvulncheck★ 0githubgithub.com/zerobytesecure/CVE-2019-19781★ 0githubgithub.com/awesome-security/citrixmash_scanner★ 0githubgithub.com/hollerith/CVE-2019-19781★ 0githubgithub.com/b510/CVE-2019-19781★ 0githubgithub.com/tpdlshdmlrkfmcla/CVE-2019-19781★ 0githubgithub.com/Castaldio86/Detect-CVE-2019-19781★ 0githubgithub.com/becrevex/Citrix_CVE-2019-19781★ 0vulncheckvulncheck.com/xdb/03c8862d3d11unverifiedvulncheckvulncheck.com/xdb/ebfe92f86902unverifiedvulncheckvulncheck.com/xdb/7ab2e8a707c8unverifiedvulncheckvulncheck.com/xdb/02742865c3b9unverifiedvulncheckvulncheck.com/xdb/943145b255e0unverifiedvulncheckvulncheck.com/xdb/b1f3cfcc972funverifiedcve_referencepacketstormsecurity.com/files/155904/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/155905/Citrix-Application-Delivery-Controller-Gateway-Remote-Code-Execution-Traversal.htmlunverifiedcve_referencepacketstormsecurity.com/files/155930/Citrix-Application-Delivery-Controller-Gateway-10.5-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/155947/Citrix-ADC-NetScaler-Directory-Traversal-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/d73f88e73b72unverifiedvulncheckvulncheck.com/xdb/74d8500487d8unverifiedcve_referencepacketstormsecurity.com/files/155972/Citrix-ADC-Gateway-Path-Traversal.htmlunverifiedvulncheckvulncheck.com/xdb/9bc4ae3b0270unverifiedvulncheckvulncheck.com/xdb/5daef00ab695unverifiedvulncheckvulncheck.com/xdb/0b44b71192ddunverifiedvulncheckvulncheck.com/xdb/34b27d809743unverifiedvulncheckvulncheck.com/xdb/f641370d0cf1unverifiedvulncheckvulncheck.com/xdb/5ebd889262c7unverifiedvulncheckvulncheck.com/xdb/f2880bad85d1unverifiedvulncheckvulncheck.com/xdb/1b40df6017f7unverifiedvulncheckvulncheck.com/xdb/d61ce8c7068dunverifiedvulncheckvulncheck.com/xdb/8d2aa3944ef3unverifiedvulncheckvulncheck.com/xdb/553ce4defd35unverifiedvulncheckvulncheck.com/xdb/83c11372ebebunverifiedvulncheckvulncheck.com/xdb/d55aabb8e817unverifiedvulncheckvulncheck.com/xdb/8effe2bc3955unverifiedvulncheckvulncheck.com/xdb/a73543340d72unverifiedvulncheckvulncheck.com/xdb/f3b2f3994c60unverifiedvulncheckvulncheck.com/xdb/eea607d2d8a4unverifiedvulncheckvulncheck.com/xdb/69c8311e600cunverifiedvulncheckvulncheck.com/xdb/103163214ca9unverifiedvulncheckvulncheck.com/xdb/bd1a9acc8fcfunverifiedvulncheckvulncheck.com/xdb/88021ad0e77bunverifiedvulncheckvulncheck.com/xdb/224739a35737unverifiedvulncheckvulncheck.com/xdb/987910f7a39dunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.