🔴 Critical: Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
-
Threat actors are actively exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to deploy web shells and attempt theft of configuration data, according to analysis by LevelBlue's Threat Hunt Operations & Research (THOR) team.
The post-exploitation activity was observed across multiple customer environments, where attackers leveraged the flaw to gain a foothold without needing valid credentials. Once inside, the attackers dropped a payload designed to accomplish two notable objectives:
- Creating a superuser account on the compromised appliance, granting persistent privileged access.
- Deploying a web shell that maps to CSS-like URL paths, a technique that helps the malicious endpoint blend in with legitimate static asset requests and evade casual inspection.
LevelBlue's THOR team identified the malicious NetScaler activity while reviewing exploitation attempts across the affected customer environments. The campaign underscores how quickly attackers move from initial access to establishing persistence once a pre-auth command injection flaw is exploited in edge-facing appliances.
The article does not provide a specific CVE ID, affected version list, or indicators of compromise, so no such identifiers are included here. Organizations running NetScaler ADC or NetScaler Gateway should treat this as a reminder to review exposure of management interfaces, audit local accounts for unexpected superuser creation, and inspect web server logs for suspicious requests to CSS-like paths.
Source: The Hacker News
Has your organization reviewed its NetScaler appliances for signs of this post-exploitation activity, and what steps are you taking to detect or remove unauthorized superuser accounts?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login