{"id":856,"date":"2023-07-19T12:33:01","date_gmt":"2023-07-19T12:33:01","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/kriticna-ranjivost-citrix-netscaler-gateway-i-adc-a\/"},"modified":"2026-11-04T08:52:46","modified_gmt":"2026-11-04T08:52:46","slug":"kriticna-ranjivost-citrix-netscaler-gateway-i-adc-a","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/kriticna-ranjivost-citrix-netscaler-gateway-i-adc-a\/","title":{"rendered":"Kriti\u010dna ranjivost Citrix Netscaler Gateway i ADC-a"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>Citrix, tvrtka koja svojim rje\u0161enjima omogu\u0107uje rad na daljinu brojnim tvrtkama i zaposlenicima, objavila je upozorenje o kriti\u010dnoj ranjivosti i pozvala sve korisnike da bez odgode a\u017euriraju svoje sustave.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kriti\u010dna ranjivost (<a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2023-3519\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2023-3519<\/a>) NetScaler ADC-a i NetScaler Gateway-a, ve\u0107 se aktivno iskori\u0161tava, ali su izdane zakrpe koje otklanjaju ranjivosti.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ranjivost CVE-2023-3519 napada\u010du omogu\u0107uje udaljeno izvr\u0161avanje k\u00f4da bez potrebe za autentifikacijom.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kako bi ranjivost mogla biti iskori\u0161tena, ranjivi ure\u0111aji moraju biti konfigurirani kao <em>gateway<\/em> (VPN virtualni poslu\u017eitelj, ICA proxy, CVPN, RDP proxy) ili kao virtualni poslu\u017eitelji za autentifikaciju (AAA server).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>NetScaler ADC i NetScaler Gateway verzije 12.1 su zastarjele i korisnicima se savjetuje prelazak na novije verzije.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Korisnici ovih servisa, bi trebali provjeriti pojavljuju li im se web shell-ovi koji su noviji od zadnjeg datuma instalacije, provjeriti logove za HTTP gre\u0161ke, te pojavljuju li se naredbe koje bi mogle sugerirati na kompromitaciju sustava.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Izdane zakrpe rje\u0161avaju jo\u0161 dvije ranjivosti: <a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2023-3466\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2023-3466<\/a> i <a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2023-3467\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2023-3467<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CVE-2023-3466<\/strong> je ranjivost koja mo\u017ee dovesti do <strong>cross-site scripting-a (XSS)<\/strong>, a mo\u017ee biti iskori\u0161tena ako \u017ertva o\u010dita poveznicu od napada\u010da, a na istoj mre\u017ei se nalazi ranjivi ure\u0111aj.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CVE-2023-3467<\/strong> je ranjivost koja napada\u010du <strong>omogu\u0107uje eskalaciju privilegija<\/strong> na one root administratora.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vi\u0161e o ovim ranjivostima pro\u010ditajte na <a href=\"https:\/\/support.citrix.com\/article\/CTX561482\/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467\">https:\/\/support.citrix.com\/article\/CTX561482\/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467<\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>Citrix, tvrtka koja svojim rje\u0161enjima omogu\u0107uje rad na daljinu brojnim tvrtkama i zaposlenicima, objavila je upozorenje o kriti\u010dnoj ranjivosti i pozvala sve korisnike da bez odgode a\u017euriraju svoje sustave. Kriti\u010dna ranjivost (CVE-2023-3519) NetScaler ADC-a i NetScaler Gateway-a, ve\u0107 se aktivno iskori\u0161tava, ali su izdane zakrpe koje otklanjaju ranjivosti. Ranjivost CVE-2023-3519 napada\u010du omogu\u0107uje udaljeno izvr\u0161avanje k\u00f4da [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1355,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-856","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/856","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=856"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/856\/revisions"}],"predecessor-version":[{"id":1357,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/856\/revisions\/1357"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1355"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=856"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=856"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=856"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=856"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=856"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}