Black Arrow Cyber Advisory 09/11/2022 – Patches available for Three Citrix Vulnerabilities
Executive Summary
Citrix has released patches to address three vulnerabilities present within Citrix Gateway and Citrix Application Delivery Controller (ADC). The vulnerabilities could allow a malicious attacker to gain unauthorised access, remote desktop takeover and bypass brute force protection on the affected products. Customers using Citrix-managed cloud services do not need to take any action to address these issues.
What’s the risk to me or my business?
These vulnerabilities could lead to a remote user gaining unauthorised access to Gateway user capabilities, ability to takeover a remote desktop session and the ability to bypass brute force protection which in turn could be used to access business data through these servers leading to further compromise.
What can I do?
Contact your Managed Service Provider to confirm if Citrix Gateway and Citrix ADC is currently being used s for you organisation and confirm if the vulnerabilities is being managed and patched in line with Citrix guidance.
Technical Summary
Only limited technical details have been supplied by Citrix so far relating to the three vulnerabilities.
CVE-2022-27510: A critical rated remote authentication bypass vulnerability which does not currently have a CVSS 3.1 rating, which allows for a remote attacker to bypass authentication using an alternate path or channel, granting user capabilities. It is important to note that only appliances that are operating as a Gateway, using the SSL VPN functionality, or being deployed as an ICA proxy with authentication enabled are affected by this vulnerability.
CVE-2022-27513: A remote desktop takeover via phishing vulnerability which does not currently have a CVSS 3.1 rating, which allows for an attacker to take advantage of insufficient verification of Data Authenticity to takeover a remote desktop session using phishing. It is important to note that the only appliances configured as a VPN Gateway with RDP Proxy functionality configured are affected by this vulnerability.
CVE-2022-27516: A brute force protection bypass vulnerability which does not currently have a CVSS 3.1 rating, which allows for an attacker to take advantage of a protection mechanism failure to brute force credentials on the user login. It is important to note that only appliances configured as a VPN gateway or AAA virtual server with the user lockout functionality “Max Login Attempts” configured are affected by this vulnerability.
Further details can be found here: https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516
Need help understanding your gaps, or just want some advice? Get in touch with us.