Citrix NetScaler Exploit Enables Pre‑Auth Shell Access and Configuration Theft

A newly uncovered vulnerability in Citrix NetScaler ADC and NetScaler Gateway is allowing attackers to inject commands before authentication, drop malicious web shells, and harvest sensitive configuration data, according to research by LevelBlue's Threat Hunt Operations & Research (THOR) team.

The flaw, classified as a pre‑authentication command injection, permits an unauthenticated user to supply crafted input to a NetScaler management endpoint. Once processed, the malicious payload creates a super‑user account on the appliance and maps a web shell to URLs that resemble legitimate CSS files, making detection more difficult for administrators.

LevelBlue observed the exploit in the wild targeting organizations that rely on NetScaler for load balancing, VPN access, and application delivery. The threat actors appear to be focused on extracting configuration files that contain credentials, certificates, and network topology details, which can be leveraged for further intrusion or lateral movement within compromised environments.

Citrix disclosed the vulnerability in early 2024 and urged customers to apply the released patches. However, the research indicates that many deployments remain unpatched, either due to the complexity of updating legacy appliances or because the devices are managed by third‑party service providers who have not yet rolled out the fixes.

Security analysts note that the use of CSS‑like URLs for the web shell is a tactical choice designed to blend in with normal web traffic. Traditional intrusion‑detection signatures that look for typical web‑shell file extensions may miss these files, underscoring the need for behavior‑based monitoring and strict network segmentation of management interfaces.

Citrix has reiterated its commitment to releasing additional hardening guidance, and the vendor recommends disabling unnecessary management services, enforcing multi‑factor authentication for any administrative access, and regularly auditing appliance configurations. Organizations are also advised to review firewall rules that expose NetScaler management ports to the internet and to consider employing a web‑application firewall that can detect anomalous request patterns.

As the investigation continues, LevelBlue’s team is tracking indicators of compromise associated with the exploit, including specific request signatures and the filenames used for the malicious shells. Their findings have been shared with a broader security community to aid in detection and response. The episode highlights the persistent risk posed by unpatched critical infrastructure components and the importance of swift remediation in the face of actively weaponized vulnerabilities.