CVE-2022-27518

What it actually does

CVE-2022-27518 is a critical unauthenticated remote code execution flaw in Citrix ADC and Citrix Gateway appliances. When the appliance is deployed in a vulnerable configuration, particularly where SAML service provider or identity provider functionality is enabled, a remote attacker can send crafted network requests that cause attacker-controlled code to execute on the appliance without credentials or user interaction. Successful exploitation can give the attacker control over the appliance software stack, enabling command execution, file modification, credential or session theft, traffic interception, persistence, and disruption of gateway services.

Why it matters to the business

Because Citrix ADC and Gateway appliances commonly sit at the internet edge and broker remote access to internal applications, exploitation can expose the organization to perimeter compromise, unauthorized access to internal services, theft of credentials or session tokens, VPN or application outage, and follow-on lateral movement. This vulnerability is listed in CISA KEV, has been exploited in the wild, and the federal remediation deadline of 2023-01-03 has long passed, so any remaining exposure should be treated as urgent regardless of the moderate EPSS value.

How an attack unfolds

An attacker first identifies internet-facing Citrix ADC or Citrix Gateway instances and fingerprints their software version and exposed authentication features. If the appliance is running a vulnerable build and SAML functionality is enabled, the attacker sends a specially crafted unauthenticated request to the SAML/authentication handling path. The vulnerable component processes the request in a way that permits arbitrary code execution. The attacker then typically runs reconnaissance commands, writes temporary files or web-accessible tooling, creates persistence, harvests credentials or session material, and uses the appliance’s trusted network position to pivot toward internal applications. Public reporting associated exploitation activity with advanced threat activity against Citrix ADC/Gateway devices, so post-remediation compromise assessment is important, not just patching.

How to fix it

Upgrade all affected Citrix ADC and Citrix Gateway appliances to a fixed, supported release. For historically affected 13.0 deployments, Citrix directed customers to upgrade to 13.0 build 58.32 or later; unsupported 12.1 deployments should be upgraded to a supported fixed branch such as a current 13.0 or 13.1 release. If immediate upgrade is not possible, reduce exposure by disabling SAML functionality where it is not required, restricting management and gateway access to trusted networks, placing additional access controls in front of the appliance, and monitoring aggressively; however, compensating controls should be considered temporary because this is unauthenticated RCE. After patching, reboot as recommended by the vendor and perform compromise assessment because patching does not remove attacker-created files, accounts, or persistence.

How to confirm the fix worked

Confirm the running Citrix ADC/Gateway build from the appliance CLI or management interface and verify it is a supported fixed version. Review the running configuration for SAML service provider or identity provider settings to determine whether the vulnerable configuration was present before remediation. Externally validate that only expected Citrix services are reachable and that management interfaces are not internet-accessible. Run vendor-recommended Citrix ADC/Gateway compromise assessment or integrity-check tooling where available. Confirm that no unexpected files, cron entries, startup scripts, local users, certificates, authentication policies, or modified gateway content remain after upgrade.

Typical attack path

1. Scan the internet for exposed Citrix ADC or Citrix Gateway services.
2. Fingerprint the appliance version and determine whether SAML authentication functionality is enabled.
3. Send crafted unauthenticated requests to the vulnerable SAML/authentication processing endpoint.
4. Achieve arbitrary command execution on the appliance.
5. Run local reconnaissance commands and inspect configuration, certificates, session data, and network reachability.
6. Deploy temporary tools, scripts, web-accessible files, or persistence mechanisms.
7. Use the compromised gateway position to capture credentials, hijack sessions, proxy traffic, or move laterally into internal services.

How to detect it

Review Citrix ADC/Gateway logs and system artifacts for signs of exploitation before and after the patch window. Useful sources include /var/log/ns.log, /var/log/httpaccess.log, /var/log/httperror.log, /var/nslog/newnslog, shell history, cron files, startup scripts, configuration change logs, and filesystem timestamps under temporary and web-accessible directories. Look for unusual unauthenticated requests to SAML or authentication endpoints, malformed SAML traffic, unexpected spikes in authentication errors, and external IPs repeatedly probing gateway paths. On the appliance, look for evidence of command execution by web/authentication service processes, unexpected child processes such as sh, bash, curl, wget, python, perl, or openssl, newly created executable files, unexpected configuration changes, added local users, modified authentication policies, modified certificates, or persistence through cron or rc scripts. Network telemetry should be reviewed for the appliance initiating unusual outbound connections, reverse shells, downloads from unfamiliar hosts, DNS lookups to rare domains, or new connections from the gateway into internal systems that do not match normal application flow. Because exploitation has been observed in the wild, include retrospective hunting back to at least December 2022 for long-lived appliances and preserve evidence before remediation where feasible.

• /var/log/ns.log
• /var/log/httpaccess.log
• /var/log/httperror.log
• /var/nslog/newnslog
• /var/tmp/
• /tmp/
• /flash/nsconfig/
• /nsconfig/rc.netscaler
• /etc/crontab
• /var/cron/tabs/
• add authentication samlAction
• set authentication samlAction
• add authentication samlIdPProfile
• set authentication samlIdPProfile
• POST /saml
• GET /saml
• POST /cgi/samlauth
• GET /cgi/samlauth
• POST /vpn/saml
• GET /vpn/saml
• nsaaad
• httpd
• /bin/sh
• /bin/bash
• wget
• curl
• python
• perl
• nc
• ncat
• openssl s_client

What your security team should do

• Treat any exposed vulnerable Citrix ADC or Gateway appliance as potentially compromised and prioritize incident response alongside patching.
• Upgrade affected appliances to a supported fixed release immediately; do not leave 12.1 or other unsupported branches exposed.
• Inventory all Citrix ADC/Gateway instances, including HA pairs, lab systems, disaster recovery appliances, and cloud marketplace deployments.
• Determine whether SAML SP or IdP functionality is enabled and prioritize those systems for immediate remediation and forensic review.
• Restrict appliance management interfaces and administrative access to dedicated trusted networks or VPN-only paths.
• Collect and preserve appliance logs, configuration backups, shell history, and filesystem timestamps before rebuilding or wiping potentially compromised devices.
• Rotate credentials, API keys, SAML signing/encryption certificates, session secrets, and administrative passwords that may have been exposed through the gateway.
• Hunt for post-exploitation activity from the appliance toward internal applications, identity systems, and management networks.
• Rebuild from known-good firmware and configuration if evidence of compromise is found or if forensic confidence is low.
• Add detections for suspicious requests to Citrix SAML/authentication endpoints and for command execution, unexpected file creation, or persistence on ADC/Gateway appliances.