US government reinforces ICBC hack link to Citrix Bleed

Commonly known as Citrix Bleed, zero-day exploitation of CVE-2023-4966 has been dated to the beginning of August, and it was added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue on 18 October, eight days after Citrix issued an update to patch it.

Mandiant researchers explained that when successfully exploited, an attacker can use CVE-2023-4966 to hijack existing authenticated sessions and bypass authentication measures, and worse still, these sessions can persist even if the Citrix patch has been deployed.

Its analysts have also observed session hijacking in which session data was stolen before the patch was deployed, and thereafter used by an attacker.

Authenticated session hijacking is a problem because it can lead to attackers gaining wider downstream access based on the permissions that identity or session had been given.

They can then steal additional credentials and start moving laterally through the victim’s network to escalate their privileges and execute their ransomware payloads.

Mandiant said it has seen exploitation at professional services, technology and public sector organisations alike.

Exploitation of Citrix Bleed by a cyber criminal gang has not, at least to public knowledge, reached the same scale of activity seen after other critical compromises, such as that targeting a flaw in Progress Software’s MOVEit tool via which the Cl0op gang attacked over a thousand victims.

However, for those users who have yet to address the issue, time is now running critically short. Besides ICBC, Citrix Bleed is now thought to be behind the LockBit attack on Boeing, from which stolen data has now been published, and an attack on a prominent US law firm. 

“NetScaler ADC is like a baton-waving traffic conductor for your online applications,” said Paul Brucciani, cyber security advisor at WithSecure. “It helps manage all the incoming user traffic, making sure it gets to the right application quickly and safely. NetScaler Gateway is like a nightclub bouncer that controls the single point of entry to your work applications.

“The vulnerability provides access to remote desktop applications and data protected behind organisations’ firewalls without generating any alerts or logs,” he said. “That’s already serious.

“It has been estimated that 75% of all internet traffic passes through Citrix NetScaler every day, which means that any vulnerability found within these appliances would put immense power into the hands of the attacker. That is why … it was rated as a critical vulnerability, scoring 9.4 out of 10.”

Considering why a bigger fuss of Citrix Bleed wasn’t made as soon as it was discovered, Brucciani said security teams – particularly those at large enterprises – were already struggling under the weight of thousands of other issues.

“Only 2% of vulnerabilities are exploited for malicious purposes, and not even banks have the resources to patch every vulnerability immediately, so which ones do you prioritise? Even if you make the right call, patching isn’t easy, especially for large organisations like ICBC operating complex IT systems that, assuming every vulnerable asset has been identified, cannot easily be taken offline for patching,” he said.