BLOG: 12 Vulnerabilities of Christmas CVE-2019-19781

Having reportedly caused the death of a hospital patient and used to compromise organisations researching COVID-19, CVE-2019-19781 is potentially one of the deadliest vulnerabilities tracked by Orpheus, earning itself a maximal OVS score of 100.

CVE-2019-19781 is a directory traversal vulnerability affecting different versions Citrix Application Delivery Controller (ADC) and Gateway, allowing attackers to write a file on disk remotely and without authentication in addition to arbitrary code execution. With a high potential for rapid lateral movement and compromise of further assets, the vulnerability immediately attracted the attention of ransomware operators and state actors alike.

The vulnerability was originally disclosed by Citrix on 17 December, 2019. Proof of Concept (PoC) code appeared on GitHub as soon as 11 January, 2020, enabling threat actors to easily integrate exploits into their operations and malware. Evidence surfaced shortly after that nation-state and cybercriminal actors started mass scanning for vulnerable instances. One of the first confirmed instances of exploitation came with a cyberattack targeting the city of Potsdam, Germany, on 24 January 2020.

Due to the nature of the vulnerability, which would allow attackers to control compromised VPN hosts and rapidly move laterally across organisations’ networks and devices, the vulnerability was swiftly exploited by ransomware operators. On 24 January 2020 Sodinokibi compromised Gedia Automotive Group, a German automobile manufacturer, which saw its stolen data and access to the compromised servers sold on dark web marketplaces shortly after the infection. The vulnerability was then exploited by DoppelPaymer on 26 January, Ragnarok on 30 January, , Nemty Ransomware-as-a-Service (RaaS) on 5 May 2020 and Maze ransomware on 8 June 2020.

A ransomware attack on the University Hospital Dusseldorf on 10 September 2020 which exploited the vulnerability has been blamed for the death of a patient as a result of the loss of availability of systems after the infection, highlighting the potential disruptive impact of these incidents on healthcare providers.

In addition to the obvious benefits for ransomware actors, CVE-2019-19781 also presented an opportunity for nation-state threat actors to infiltrate vulnerable targets for intelligence collection. Iranian group OilRig was the first to be observed exploiting the vulnerability on 16 February 2020 to target organisations in a variety of industries and sectors, including government entities, security, aviation, oil and gas, telecommunications and security. Another Iranian group, Pioneer Kitten, was also seen using the vulnerability in September 2020 after advertising compromised Citrix servers on cybercriminal forums.

Reports in March 2020 revealed that Chinese threat actor APT41 had been conducting cyber espionage campaigns between 20 January 2020 and 11 March 2020 which leveraged the vulnerability to target organisations in 20 different countries and across all sectors. A suspected Chinese state operation also targeted Australian organisations in June 2020. Following the suite of Iranian and Chinese threat actors, Russian group APT29 also exploited the vulnerability to target UK and US organizations conducting research on COVID-19 vaccines in July 2020.

Despite the continued exploitation of CVE-2019-19781 by threat actors with potentially lethal or disastrous consequences for organisations and healthcare entities, Shodan data shows that up to 771 vulnerable servers are still operating around the world. A majority of these are located in the United States (233), followed by China (90), South Korea (50) and Taiwan (35).

In light of continued exploitation of this vulnerabilty by ransomware operators and state actors as well as current exposure of vunlerable servers worldwide, we urge organisations using affected Citrix products to apply the following mitigaiton advice in order to prevent exploitation by attackers:

• Upgrade Citrix ADC and Gateway to the latest available version
• Apply the mitigation steps outlined by Citrix for CVE-2019-19781
• Obfuscate server HTTP banners and close open ports in order to minimise malicious scanning activity for vulnerable hosts