Citrix NetScaler ADC and Gateway Unauthenticated Remote Code Execution Vulnerability (CVE-2023-3519) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-3519) is an unauthenticated remote code execution (RCE) vulnerability residing in the SAML (Security Assertion Markup Language) processing logic of Citrix NetScaler ADC and Gateway. When the appliance is configured to function as a SAML Service Provider (SP) or Identity Provider (IdP), insufficient input validation on incoming malicious requests leads to memory corruption (such as stack-based buffer overflow), allowing attackers to bypass authentication and execute code within the system context.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by sending a specially crafted HTTP request to the SAML endpoints (e.g., /saml/consume) of the target NetScaler appliance. By supplying excessively long values in specific fields within the request headers or SAML payload, the attacker triggers a buffer overflow in the internal parser. This overwrites the instruction pointer, redirecting execution flow to attacker-controlled shellcode, enabling them to deploy web shells, establish backdoor accounts, and conduct reconnaissance.

3. Infrastructure & Business Impact

NetScaler ADC and Gateway serve as critical perimeter infrastructure controlling remote access (VPN) and traffic distribution. With a CVSS score of 9.8, this vulnerability is highly critical and has been actively exploited in the wild, leading to its inclusion in the CISA KEV catalog. Compromise of these appliances allows attackers to decrypt TLS traffic, harvest user credentials, and establish a persistent foothold to perform lateral movement into the internal corporate network (such as Active Directory), posing an existential threat to business operations.