Exploit for Code Injection in Citrix Netscaler Application Delivery Controller

githubexploit · 2023-07-21

Description

Detects CVE-2023-3519 unauthenticated remote code execution on Citrix ADC and Gateway.

Affected software

Citrix Netscaler Application Delivery Controller< 12.1-55.297, 13.0-91.13, 13.1-37.159, 13.1-49.13

Citrix Netscaler Gateway< 13.0-91.13, 13.1-49.13

All known vulnerabilities by product

Citrix Adc Citrix Netscaler Adc Citrix Netscaler Gateway

CVSS 9.8 for CVE-2023-3519

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

100%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

99.7%higher than 100.0% of all CVEs

Updated 2026-07-21

Exploit Details

Modified:2023-10-02 06:20

Last Seen:2025-08-29 10:49

Reporter:SalehLardhi

Last commit:2023-07-21

Tags

Citrix ADCGatewayRemote code executionUnauthenticated access

Other exploits for CVE-2023-3519

Exploit for Code Injection in Citrix Netscaler_Application_Delivery_Controller

2023-10-27 MohammaddvdGITHUB

Exploit for Code Injection in Citrix Netscaler_Application_Delivery_Controller

2023-08-31 JonaNeidhartGITHUB

Exploit for Code Injection in Citrix Netscaler_Application_Delivery_Controller

2023-08-24 ChocapikkGITHUB

Citrix ADC nsppe buffer overflow

2023-08-09 SAINT CorporationSAINT

Citrix ADC nsppe buffer overflow

2023-08-09 SAINT CorporationSAINT

Citrix ADC (NetScaler) Remote Code Execution Exploit

2023-08-08 metasploitZDTRuby

Exploit for Code Injection in Citrix Netscaler_Application_Delivery_Controller

2023-08-06 rwinceyGITHUB

Exploit for Code Injection in Citrix Netscaler_Application_Delivery_Controller

2023-08-05 passwa11GITHUB

Exploit Code

README31 lines

## https://sploitus.com/exploit?id=58BB14E0-273F-552A-9963-49B727DC283E
# CVE-2023-3519
This Nuclei template checks for the presence of the CVE-2023-3519 vulnerability in a target web server.

## Vulnerability

CVE-2023-3519 is a vulnerability that allows unauthenticated remote code execution in the Citrix Application Delivery Controller (ADC) and Gateway appliances. An attacker can exploit this vulnerability by sending a specially crafted request to the affected system.

This template checks for the presence of the vulnerability by comparing the "Last-Modified" header in the server response to known patched versions.

## Usage

To scan a single target with Nuclei, use the following command:

```
nuclei -target  -t cve-2023-3519.yaml
```

To scan multiple targets, use a file containing a list of targets:

```
nuclei -l  -t cve-2023-3519.yaml
```
## Analysis

https://blog.assetnote.io/2023/07/21/citrix-CVE-2023-3519-analysis/

## References

- [NVD CVE-2023-3519 ↗](https://nvd.nist.gov/vuln/detail/CVE-2023-3519)
- [Deutsche Telekom CERT on Twitter ↗](https://twitter.com/DTCERT/status/1682032701430452233)