Authenticated Remote Code Execution Vulnerability in NetScaler Management Interface
CVE-2023-6548

5.5MEDIUM

Key Information:

Vendor
Cloud Software Group
Status
Netscaler Adc
Netscaler Gateway
Vendor
CVE Published:
17 January 2024

Badges

📈 Trended📈 Score: 5,320💰 Ransomware👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2023-6548?

CVE-2023-6548 is a critical vulnerability identified in the NetScaler Management Interface of NetScaler ADC and NetScaler Gateway products offered by Cloud Software Group. This vulnerability involves improper control over code generation, leading to potential remote code execution by authenticated users who have access to specific network interfaces (NSIP, CLIP, or SNIP). Organizations leveraging these products may face severe risks if the vulnerability is exploited, as it allows low-privileged attackers to execute arbitrary code on the management interface, compromising the security and integrity of their network.

Technical Details

The vulnerability arises from insufficient controls over code execution processes within the NetScaler Management Interface. Attackers who manage to gain authenticated access, even with low privileges, can exploit this flaw to inject and execute malicious code. The vulnerability's root cause is attributed to how the system handles and generates code, enabling unauthorized actions through legitimate user credentials. Organizations must be aware of their network configurations and access controls to mitigate this risk effectively.

Impact of the Vulnerability

  1. Unauthorized Remote Code Execution: The primary impact of CVE-2023-6548 is the ability for attackers to execute arbitrary code on the management interface, which can lead to unauthorized control over critical system functionalities and configurations.

  2. Compromise of Sensitive Data: Successful exploitation can result in the exposure of sensitive information, such as user credentials, configuration files, or confidential data stored within the affected systems, posing significant privacy and compliance risks.

  3. Escalation of Privileges: This vulnerability could serve as a foothold for attackers to escalate their privileges within the network, potentially leading to lateral movement or attacks on other systems connected to the NetScaler infrastructure, further endangering the overall security posture of the organization.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

NetScaler ADC  14.1 < 12.35

NetScaler ADC  13.1 < 51.15

NetScaler ADC  13.0 < 92.21

News Articles

favicon imageArctic Wolf

CVE-2023-6548 & CVE-2023-6549: DoS and RCE Vulnerabilities Exploited in Citrix NetScaler ADC and NetScaler Gateway - Arctic Wolf

On January 16, 2024, Citrix published a security bulletin disclosing two zero-day vulnerabilities (CVE-2023-6548 & CVE-2023-6549) being actively exploited in Citrix NetScaler ADC and NetScaler Gateway.   CVE-2023-6548 CVSS 5.5 – Medium Actively Exploited? Code injection vulnerability on the Manageme...

1 year ago

favicon imageAttackerKB

CVE-2023-6548 | AttackerKB

Improper Control of Generation of Code (&#39;Code Injection&#39;) in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with mana…

1 year ago

favicon imageDuo Security

Citrix Discloses Actively Exploited NetScaler ADC and Gateway Flaws

Flaws in Citrix NetScaler and ADC Gateway have historically been targeted by threat actors, though researchers don’t believe the impact of these two bugs to match that of CitrixBleed.

1 year ago

References

https://support.citrix.com/article/CTX584986/netscaler-ad...

EPSS Score

1% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 💰

    Used in Ransomware

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • 📰

    First article discovered by BornCity

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre DatabaseCISA Database0 Proof of Concept(s)17 News Article(s)
.