Security News > 2020 > January > Exploits for Citrix ADC and Gateway flaw abound, attacks are ongoing

With several exploits targeting CVE-2019-19781 having been released over the weekend and the number of vulnerable endpoints still being over 25,000, attackers are having a field day.

Some other researchers then published exploits and scanners for it.

The exploit published by TrustedSec "Works well" and establishes a reverse shell, SANS ISC's Johannes Ullrich noted.

"We do see heavy exploitation of the flaw using variations of both exploits. Most attempts follow the 'Project Zero India' pattern, which is likely simpler to include in existing exploit scripts. Much of the scanning we have been seen so far is just testing the vulnerability by attempting to run commands like 'id' and 'uname'," he shared.

"A few exploits attempted to download additional code. I was successful retrieving one sample so far, a simple Perl backdoor."

News URL

http://feedproxy.google.com/~r/HelpNetSecurity/~3/cgeGcooZ90I/