Article Details
Scrape Timestamp (UTC): 2023-11-21 16:37:57.284
Original Article Text
Click to Toggle View
Citrix warns admins to kill NetScaler user sessions to block hackers. Citrix reminded admins today that they must take additional measures after patching their NetScaler appliances against the CVE-2023-4966 'Citrix Bleed' vulnerability to secure vulnerable devices against attacks. Besides applying the necessary security updates, they're also advised to wipe all previous user sessions and terminate all active ones. This is a crucial step, seeing that attackers behind ongoing Citrix Bleed exploitation have been stealing authentication tokens, allowing them to access compromised devices even after they have been patched. Citrix patched the flaw in early October, but Mandiant revealed that it has been under active exploitation as a zero-day since at least late August 2023. Mandiant also warned that compromised NetScaler sessions persist after patching, enabling attackers to move laterally across the network or compromise other accounts depending on the compromised accounts' permissions. "If you are using any of the affected builds listed in the security bulletin, you should upgrade immediately by installing the updated versions. After you upgrade, we recommend that you remove any active or persistent sessions," Citrix said today. This is the second time the company has warned customers to kill all active and persistent sessions using the following commands: Exploited in LockBit ransomware attacks Today, CISA and the FBI cautioned that the LockBit ransomware gang is exploiting the Citrix Bleed security flaw in a joint advisory with the Multi-State Information Sharing & Analysis Center (MS-ISAC) and the Australian Cyber Security Center (ACSC). The agencies also shared indicators of compromise and detection methods to help defenders thwart the ransomware group's attacks. Boeing also shared information on how LockBit breached its network in October using a Citrix Bleed exploit, which led to 43GB of data stolen from Boeing's systems getting leaked on the dark web after the company refused to give in to the ransomware gang's demands. "Boeing observed LockBit 3.0 affiliates exploiting CVE-2023-4966, to obtain initial access to Boeing Distribution Inc., its parts and distribution business that maintains a separate environment. Other trusted third parties have observed similar activity impacting their organization," the joint advisory warns. "Responding to the recently disclosed CVE-2023-4966, affecting Citrix NetScaler ADC and NetScaler Gateway appliances, CISA received four files for analysis that show files being used to save registry hives, dump the Local Security Authority Subsystem Service (LSASS) process memory to disk, and attempts to establish sessions via Windows Remote Management (WinRM)," CISA added in a Malware Analysis Repor also published today. According to security researchers, over 10,000 Internet-exposedCitrix servers were vulnerable to Citrix Bleed attacks one week ago.
Daily Brief Summary
Citrix has reiterated to administrators the importance of invalidating all user sessions after applying patches for the CVE-2023-4966 vulnerability, known as 'Citrix Bleed'.
The company previously patched the flaw in early October but active exploitation has occurred since at least late August 2023.
Attackers have been stealing authentication tokens through this vulnerability, allowing them access to devices even after patches are applied.
Mandiant revealed that exploited NetScaler sessions continue to pose a risk after patching, enabling network lateral movement or further account compromises.
The warning follows reports that the LockBit ransomware group is leveraging the Citrix Bleed flaw, as highlighted by a joint advisory from CISA, the FBI, and others.
Boeing disclosed an instance where LockBit 3.0 affiliates exploited CVE-2023-4966, leading to a significant data breach and subsequent leak on the dark web.
CISA's malware analysis report indicates that the exploit has been used for malicious activities including saving registry hives and dumping LSASS process memory.
It's reported that over 10,000 Citrix servers exposed to the internet were vulnerable to attacks a week prior to the advisory.