cyber.hendryadrian.com
Vulnerability & Exploit · wiz.io

Citrix ADC Vulnerability CVE-2022-27518 Exploited by APT5

· Original article ↗

Summary

The NSA and Citrix reported APT5 exploitation of CVE-2022-27518, an unauthenticated remote-code-execution flaw affecting certain older, customer-managed Citrix ADC and Gateway appliances. Citrix issued fixes; disabling SAML is a workaround.

Key points

  • The NSA and Citrix reported that APT5, also known as UNC2630 and MANGANESE, was actively exploiting CVE-2022-27518.
  • Citrix describes the flaw as allowing unauthenticated remote code execution; the article says exact exploit details were not publicly available.
  • Affected appliances must use a vulnerable Citrix ADC or Gateway version and have a SAML service-provider or identity-provider configuration. Citrix 13.1 is unaffected.
  • The article lists affected branches as ADC and Gateway 13.0 before 13.0-58.32, ADC and Gateway 12.1 before 1-65.25, and ADC 12.1-FIPS and 12.1-NDcPP before 12.1-55.291.
  • Citrix recommends updating to 12.1-65.25 or 13.0-88.16, or using any 13.1 build; disabling SAML authentication is an alternative workaround where possible.
  • The NSA published threat-hunting guidance. The article says Citrix-managed cloud services and Citrix-managed Adaptive Authentication require no action.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution
  • Authentication bypass
Affected Versions
  • Citrix ADC 13.0 earlier than 13.0-58.32
  • Citrix Gateway 13.0 earlier than 13.0-58.32
  • Citrix ADC 12.1 earlier than 12.1-65.25
  • Citrix Gateway 12.1 earlier than 12.1-65.25
  • Citrix ADC 12.1-FIPS earlier than 12.1-55.291
  • Citrix ADC 12.1-NDcPP earlier than 12.1-55.291
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Disable SAML authentication if possible.

CVE

CVE-2022-27518What is CVE-2022-27518?

Threat Actors

APT5Identified by the NSA and Citrix as actively exploiting CVE-2022-27518; the article states that UNC2630 and MANGANESE are also names for this actor.

Vendors

CitrixOn December 13, 2022, the National Security Agency (NSA) released an advisory warning of exploitation in-the-wild of Citrix products by APT5, a threat actor attributed to China.

Products

Citrix ADCattacker to perform arbitrary code execution on the appliance. By targeting vulnerable instances of Citrix ADC, attackers can exploit this vulnerability to bypass authentication controls and obtain access toCitrix GatewayThe following versions of Citrix ADC and Citrix Gateway (a feature-reduced offering of ADC) are affected by this vulnerability:

Countries

ChinaOn December 13, 2022, the National Security Agency (NSA) released an advisory warning of exploitation in-the-wild of Citrix products by APT5, a threat actor attributed to China.

Industries

TechnologyMANGANESE), a Chinese state-backed threat actor that has been known to target telecommunications and technology companies and has previously exploited vulnerabilities in Pulse Secure VPNs. Exact details about theTelecommunicationsknown as UNC2630 and MANGANESE), a Chinese state-backed threat actor that has been known to target telecommunications and technology companies and has previously exploited vulnerabilities in Pulse Secure VPNs. Exact

Related Articles