Citrix ADC and Citrix Gateway Security Bulletin for CVE-2023-3519, CVE-2023-3466

"...the NetScaler CLI allows for the stacking of commands. This means that it is possible to stack the man and whoami commands. If these commands are stacked, the NetScaler shows that the man command failed to execute because without a parameter the man command does not know which manual must be opened. Still, whoami is executed successfully.

By running man ; shell, the man command errors out again, as expected. However, this time the shell command is executed, and no error is displayed that tells that the authorisation for executing the shell command is missing."

https://www.resillion.com/wp-content/uploads/2023/07/Resilli...

"Citrix ADC and Citrix Gateway Security Bulletin for CVE-2023-3519, CVE-2023-3466, CVE-2023-3467"

This is a zero-day exploit.

"Exploits of CVE-2023-3519 on unmitigated appliances have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible. "