{"data":{"case":{"actions":{"de":["Nutze eine unterstützte NetScaler-Version wie **14.1** mit allen aktuellen Updates. Die betroffenen Versionen 10.5 bis 13.0 erhalten keine Sicherheitsupdates mehr; für 13.0 endete der Support am 15. Juli 2024.","Lief ein Gateway im Januar 2020 ohne den Fix oder den Workaround, lass es auf Spuren eines Angriffs prüfen: Ein Update entfernt keine Hintertür, die vorher eingeschleust wurde. Wurde es kompromittiert, setze es neu auf und ersetze seine Zertifikate.","Installiere Sicherheitsupdates für Fernzugriffs-Gateways binnen weniger Tage: Im Januar 2020 begannen die Massenangriffe binnen eines Tages nach der Veröffentlichung des Angriffscodes."],"en":["Run a supported NetScaler release such as **14.1** with all current updates. The affected versions 10.5 to 13.0 get no more security fixes; 13.0 reached its end of life on July 15, 2024.","If a gateway ran without the fix or the workaround in January 2020, have it checked for signs of attack: an update does not remove a backdoor planted before it. If it was compromised, set it up anew and replace its certificates.","Install security updates for remote access gateways within days: in January 2020, mass attacks began within a day of the attack code's release."]},"criteria":{"damage":{"de":"Angreifer, die über das Citrix-Gateway eingedrungen waren, verschlüsselten im September 2020 etwa 30 Server des Universitätsklinikums Düsseldorf (Justizministerium NRW, September 2020). Das Klinikum musste sich für 13 Tage von der Notfallversorgung abmelden (BSI, 2021).","en":"Attackers who had come in through the Citrix gateway encrypted about 30 servers of Düsseldorf University Hospital in September 2020 (NRW Ministry of Justice, September 2020). The hospital had to stay off emergency care for 13 days (BSI, 2021).","met":true},"exploitation":{"de":"Fox-IT fand bis Juni 2020 auf 3.332 Servern bekannte Spuren einer Kompromittierung (Fox-IT, Juli 2020). Behörden aus den USA, Großbritannien und Australien nannten die Lücke die am häufigsten ausgenutzte des Jahres 2020 (CISA-Warnung AA21-209A, Juli 2021).","en":"Fox-IT found known signs of compromise on 3,332 servers by June 2020 (Fox-IT, July 2020). Agencies of the US, the UK and Australia called it the most exploited flaw of 2020 (CISA advisory AA21-209A, July 2021).","met":true},"reach":{"de":"Ein weltweiter Scan fand im Dezember 2019 schätzungsweise 128.777 verwundbare Server (DIVD-Fallbericht, 2020).","en":"A worldwide scan in December 2019 found an estimated 128,777 vulnerable servers (DIVD case report, 2020).","met":true},"response":{"de":"Das niederländische NCSC stufte die Lücke auf die höchste Stufe hoch. Es forderte Regierung und Betreiber kritischer Dienste dringend auf, ihre Citrix-Server bis zum Fix abzuschalten (Brief der niederländischen Regierung an das Parlament, 23. Januar 2020).","en":"The Dutch NCSC raised its rating to the highest level. It urged the government and operators of vital services to switch off their Citrix servers until a fix existed (Dutch government's letter to parliament, January 23, 2020).","met":true}},"cves":["CVE-2019-19781"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-22","dates":[{"date":"2019-12-17","key":"disclosed"},{"date":"2020-01-11","key":"exploited"},{"date":"2020-01-17","de":"Das niederländische NCSC rät, Citrix-Server abzuschalten, bis es einen Fix gibt","en":"The Dutch NCSC advises switching off Citrix servers until a fix exists"},{"date":"2020-01-19","key":"patched"},{"date":"2020-01-24","de":"Mit Version 10.5 bekommt die letzte betroffene Version ihren Fix","en":"With version 10.5, the last affected version gets its fix"},{"date":"2020-09-10","de":"Ransomware, die über ein Citrix-Gateway eingedrungen ist, trifft das Universitätsklinikum Düsseldorf","en":"Ransomware that came in through a Citrix gateway hits Düsseldorf University Hospital"},{"date":"2021-07-28","de":"Behörden aus den USA, Großbritannien und Australien nennen sie die am häufigsten ausgenutzte Sicherheitslücke des Jahres 2020","en":"Agencies of the US, the UK and Australia name it the most exploited flaw of 2020"},{"date":"2021-11-03","key":"kev"}],"de":{"credit":"Positive Technologies","fixed":"Citrix ADC und Gateway 11.1 Build 63.15 und 12.0 Build 63.13 (19. Januar 2020), 12.1 Build 55.18 und 13.0 Build 47.24 (23. Januar), 10.5 Build 70.12 (24. Januar 2020)","product":"Citrix ADC und Citrix Gateway (heute wieder NetScaler genannt), Geräte für den Fernzugriff auf interne Netze","summary":"Eine Sicherheitslücke in den Fernzugriffs-Gateways von Citrix ließ jeden im Internet die Geräte ohne Passwort übernehmen. 33 Tage lang gab es nur einen Workaround."},"disclosed":"2019-12-17","en":{"credit":"Positive Technologies","fixed":"Citrix ADC and Gateway 11.1 build 63.15 and 12.0 build 63.13 (January 19, 2020), 12.1 build 55.18 and 13.0 build 47.24 (January 23), 10.5 build 70.12 (January 24, 2020)","product":"Citrix ADC and Citrix Gateway (today again called NetScaler), devices for remote access to internal networks","summary":"A flaw in Citrix's remote access gateways let anyone on the internet take them over without a password. For 33 days, only a workaround existed."},"figures":[{"de":"verwundbare Server weltweit im Dezember 2019 (Schätzung aus einem Scan; DIVD)","en":"vulnerable servers worldwide in December 2019 (estimate from a scan; DIVD)","value":"128,777"},{"de":"Server mit bekannten Spuren eines Angriffs bis Juni 2020 (Fox-IT)","en":"servers with known signs of attack by June 2020 (Fox-IT)","value":"3,332"},{"de":"Tage vergingen zwischen der Warnung von Citrix und den ersten Fixes","en":"days from Citrix's warning to the first fixes","value":"33"},{"de":"Tage in Folge war das Universitätsklinikum Düsseldorf von der Notfallversorgung abgemeldet (BSI)","en":"days in a row Düsseldorf University Hospital was off emergency care (BSI)","value":"13"}],"kev":"2021-11-03","key":"citrix-adc","name":"Citrix ADC","product":"Citrix ADC and Citrix Gateway","sources":[{"de":"Citrix-Sicherheitshinweis CTX267027 zu CVE-2019-19781","title":"Citrix security bulletin CTX267027 for CVE-2019-19781","url":"https://support.citrix.com/article/CTX267027"},{"de":"NVD: CVE-2019-19781","title":"NVD: CVE-2019-19781","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19781"},{"de":"CERT/CC-Schwachstellenhinweis VU#619785, mit dem Workaround","title":"CERT/CC vulnerability note VU#619785, with the workaround","url":"https://www.kb.cert.org/vuls/id/619785"},{"de":"CISA-Warnung AA20-020A, mit den korrigierten Builds und ihren Daten","title":"CISA alert AA20-020A, with the fixed builds and their dates","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-020a"},{"de":"CISA-Warnung AA20-031A: kompromittierte Citrix-Geräte erkennen","title":"CISA alert AA20-031A: detecting compromised Citrix devices","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-031a"},{"de":"CISA, FBI, ACSC und NCSC-UK: die am häufigsten ausgenutzten Schwachstellen (28. Juli 2021)","title":"CISA, FBI, ACSC and NCSC-UK: top routinely exploited vulnerabilities (July 28, 2021)","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a"},{"de":"DIVD: Fallbericht zu CVE-2019-19781, mit Scan-Ergebnissen","title":"DIVD: case report on CVE-2019-19781, with scan results","url":"https://www.divd.nl/newsroom/articles/b6f6e14afadc/"},{"de":"SANS Internet Storm Center: Exploits für Citrix ADC sind öffentlich und werden stark genutzt (11. Januar 2020)","title":"SANS Internet Storm Center: Citrix ADC exploits are public and heavily used (January 11, 2020)","url":"https://isc.sans.edu/diary/25700"},{"de":"FireEye (Mandiant): ein Angreifer, der andere Angreifer aussperrt, sich selbst aber eine Hintertür offenhält (15. Januar 2020)","title":"FireEye (Mandiant): an attacker that blocks other attackers but keeps a backdoor (January 15, 2020)","url":"https://cloud.google.com/blog/topics/threat-intelligence/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor/"},{"de":"Fox-IT: ein zweiter Blick auf CVE-2019-19781, mit der Zahl kompromittierter Server (1. Juli 2020)","title":"Fox-IT: a second look at CVE-2019-19781, with counts of compromised servers (July 1, 2020)","url":"https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/"},{"de":"Niederländische Regierung: Brief an das Parlament zur Citrix-Sicherheitslücke (23. Januar 2020, auf Niederländisch)","title":"Dutch government: letter to parliament on the Citrix flaw (January 23, 2020, in Dutch)","url":"https://zoek.officielebekendmakingen.nl/kst-26643-660.html"},{"de":"Niederländisches NCSC: Citrix-Systeme nach Möglichkeit abschalten (Januar 2020, auf Niederländisch)","title":"Dutch NCSC: switch off Citrix systems where possible (January 2020, in Dutch)","url":"https://www.ncsc.nl/actueel/nieuws/2020/januari/16/door-citrix-geadviseerde-mitigerende-maatregelen-niet-altijd-effectief"},{"de":"BSI: Aktive Ausnutzung der Citrix-Schwachstelle (16. Januar 2020)","title":"BSI: active exploitation of the Citrix flaw (January 16, 2020, in German)","url":"https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2020/Citrix_Schwachstelle_160120.html"},{"de":"BSI: Cyber-Angriff auf Uniklinik Düsseldorf, BSI warnt vor akuter Ausnutzung bekannter Schwachstelle (17. September 2020)","title":"BSI: cyber attack on Düsseldorf University Hospital, warning of the Citrix flaw (September 17, 2020, in German)","url":"https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2020/UKDuesseldorf_170920.html"},{"de":"BSI: Die Lage der IT-Sicherheit in Deutschland 2021, mit dem Fall des Klinikums auf Seite 15 (PDF)","title":"BSI: the state of IT security in Germany 2021, with the hospital case on page 15 (PDF, in German)","url":"https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2021.pdf?__blob=publicationFile\u0026v=3"},{"de":"Justizministerium NRW: Bericht an den Landtag zum Stand des Ermittlungsverfahrens zum Cyberangriff auf die Uniklinik Düsseldorf (September 2020, PDF)","title":"NRW Ministry of Justice: report to the state parliament on the attack on Düsseldorf University Hospital (September 2020, PDF, in German)","url":"https://www.landtag.nrw.de/portal/WWW/dokumentenarchiv/Dokument/MMV17-3855.pdf"},{"de":"Wissenschaftsministerium NRW: Bericht an den Landtag zum IT-Ausfall am Düsseldorfer Uniklinikum (September 2020, PDF)","title":"NRW Ministry of Culture and Science: report to the state parliament on the IT outage at the hospital (September 2020, PDF, in German)","url":"https://www.landtag.nrw.de/portal/WWW/dokumentenarchiv/Dokument/MMV17-3934.pdf"},{"de":"Justizministerium NRW: Stand der Ermittlungen, mit dem Ergebnis zum Tod einer Patientin (Januar 2021, PDF)","title":"NRW Ministry of Justice: status of the investigation, with the findings on the death of a patient (January 2021, PDF, in German)","url":"https://www.landtag.nrw.de/portal/WWW/dokumentenarchiv/Dokument/MMV17-4545.pdf"},{"de":"NetScaler: Release-Zyklus der Firmware, mit dem Supportende der Versionen","title":"NetScaler: firmware release cycle, with end-of-life dates","url":"https://support.citrix.com/external/article/CTX241500/netscaler-adc-firmware-release-cycle.html"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2019}},"description":"In December 2019, a flaw in Citrix's remote access gateways let attackers in without a password, with no fix for 33 days. How it worked, who was hit.","language":"en","latest_measurement":"2026-11-01","method":"latency-v3","method_page":"https://crackthe.net/data/method/","source":"https://crackthe.net/","text":"On December 17, 2019, Citrix warned of a flaw in Citrix ADC and Citrix Gateway. It let anyone on the internet run commands on these devices without a password. The devices stand at the edge of many company and government networks. They let staff reach internal applications from outside and spread incoming traffic across servers. At first Citrix had no fix, only a workaround. The first fixes came 33 days later, on January 19, 2020. By then, attack code was public and attacks were under way around the world.\nHow it worked Citrix Gateway has a built-in web server that shows users the login page. Behind it lies a folder named /vpns/ with small programs, Perl scripts, that should be reachable only after logging in. The flaw, CVE-2019-19781, is a path traversal. An attacker puts “../” into the address of a request, as in /vpn/../vpns/. This lets the attacker climb out of the public area and reach these scripts without logging in.\nThe CERT Coordination Center at Carnegie Mellon University described one way to use this. A first request makes one of the scripts write a file with hidden commands onto the device. A second request makes the device read that file as a template for a web page, and the commands run. The attacker then controls a device that sits between the internet and the internal network.\nAttackerputs ../ into the address of a request Citrix gatewaylets it reach scripts meant for logged-in users Scriptwrites a file with hidden commands Gatewayruns the commands Internal networklies open behind the gateway Two requests without a password were enough to take over the gateway. Citrix\u0026rsquo;s workaround was a rule that rejects requests containing “/../” or aimed at /vpns/. On some builds of version 12.1, a separate bug kept the rule from working. The flaw affected versions 10.5 to 13.0. In January 2020, Citrix found that its SD-WAN WANOP appliances were affected too. They contain Citrix ADC. Citrix ADC was formerly called NetScaler ADC, and today it is sold under that name again.\nReach and damage The Dutch volunteer group DIVD searches the internet for vulnerable systems and warns their owners. According to DIVD, a worldwide scan in December 2019 found an estimated 128,777 vulnerable servers. The security company Positive Technologies, which had found the flaw, put the number of companies at risk at 80,000 in 158 countries. In Germany, the federal cyber security agency BSI had reported almost 5,000 vulnerable systems to network operators since January 7, 2020. On January 16, about 1,500 of them were still open, and the BSI had numerous reports of successful attacks.\nOn the night of January 10 to 11, 2020, several groups published working attack code. The SANS Internet Storm Center, an early warning service of the SANS Institute, saw “heavy exploitation” the next day. The security company FireEye found successful attacks by several groups before January 12. One of them deleted other attackers\u0026rsquo; tools and blocked further attacks. But it kept a backdoor, a hidden way back in that only it could open with a secret key.\nThe update did not remove such backdoors. The Dutch security company Fox-IT found known signs of compromise on 1,030 servers in January 2020. By June 2020, it found them on 3,332, including servers of government organizations and Fortune 500 companies. Of the compromised servers in June, 23 % had been patched but still had a backdoor. In July 2021, agencies of the United States, the United Kingdom and Australia called CVE-2019-19781 the most exploited flaw of 2020.\nServers with known signs of compromise January 20201,030 June 20203,332 Fox-IT counted only the backdoors and traces it knew. Source: Fox-IT (July 2020).\nThe worst documented damage came months later. In September 2020, attackers encrypted about 30 servers of Düsseldorf University Hospital with ransomware. This malware locks data and demands money for its release. According to the BSI, they had entered through the hospital\u0026rsquo;s Citrix gateway. They had compromised it before the update was installed. The fixes were installed there from January 27, 2020. The hospital could not admit emergency patients for 13 days in a row. Its central emergency department reopened on September 23, 2020. The ransom note was addressed to the university to which the hospital belongs. The police told the attackers that they had hit a hospital. The attackers then handed over a key to restore the data.\nOn the night of September 11 to 12, a critically ill woman was to be brought to the hospital by ambulance. She was taken to a hospital further away in Wuppertal instead, with a delay of about 20 to 25 minutes, and died. Prosecutors concluded in January 2021 that she would very likely have died even with earlier treatment. So a link between the attack and her death could not be proven.\nThe fix and the response Citrix released the fixes version by version:\nDays from Citrix\u0026#39;s warning to the fix Versions 11.1 and 12.033 SD-WAN WANOP36 Versions 12.1 and 13.037 Version 10.538 Counted from the warning of December 17, 2019, to the fixes of January 19 to 24, 2020. Source: CISA.\nBefore the fixes, governments went further than usual. The Dutch National Cyber Security Centre (NCSC) raised its rating of the flaw to the highest level on December 24, 2019. It became unclear whether Citrix\u0026rsquo;s workaround was effective in all cases. On January 17, 2020, the NCSC urgently advised the government and operators of vital services to switch off their Citrix servers until a fix existed. The chief information officer of the Dutch government asked ministries to do the same unless strict conditions were met. According to the government, the first fixes covered about half of the vulnerable systems in the Netherlands.\nIn the United States, CISA, the federal agency for cyber security, released a free tool on January 13, 2020. It checks whether a device is vulnerable. On January 22, Citrix and FireEye released a scanner that looks for signs of attack. On January 31, CISA warned that unknown attackers had compromised numerous organizations. It also warned that a patch does not clean up an already compromised device. The BSI repeated this warning after the attack on the hospital in September 2020. On November 3, 2021, CISA added the flaw to its catalog of exploited vulnerabilities.\nThe National Vulnerability Database rates CVE-2019-19781 9.8 out of 10, “critical”. An attacker needs neither a password nor help from a user and can take full control of the device.","title":"Citrix ADC: the gateway flaw that opened internal networks","url":"https://crackthe.net/security/vulnerabilities/citrix-adc/"}