Patchfirst
Patchfirst
CVE-2022-27518 KEVPublic exploit Critical · 9.8 EPSS 6.9%

Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

Citrix · Application Delivery Controller (ADC) and Gateway

Summary

The flaw is an authentication bypass in Citrix Application Delivery Controller (ADC) and Gateway, arising from improper control of a resource through its lifetime. An unauthenticated remote attacker can achieve arbitrary code execution over the network, with no user interaction and no prior authentication required.

Official description · NVD

Unauthenticated remote arbitrary code execution

Breakdown
72.5 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 35 days after disclosure.

  1. DisclosedFirst seen exploitedVulnCheck KEV evidenceAdded to CISA KEVEU database agreesday 0
  2. Public exploit codePoC-in-GitHub+35 days

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

Unauthenticated remote exploit of public-facing appliance

Unauthenticated remote arbitrary code execution
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium
AI mapping from the description · primary impact

Arbitrary code execution is the direct impact

Unauthenticated remote arbitrary code execution
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2022-27518 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportGoogle Mandiant

Reports are matched by finding the exact id CVE-2022-27518 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag (1 duplicate merged)

Vendor Advisory 1

support.citrix.com/article/CTX474995

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27518
↑ ↓ chooseEnter openEsc close