CVE-2019-19781 Explained: Citrix ADC and Gateway Path Traversal RCE

The Citrix ADC and Gateway web portal routes HTTP requests to internal scripts and resources. Certain URL paths intended for internal use fail to enforce authentication before processing. By injecting path traversal sequences into the URL, an unauthenticated attacker can reach Perl scripts outside the web root that are accessible to the management portal.

The exploit runs in two stages. First, the attacker sends a POST request to a traversal path that writes a Perl or shell payload to a temporary location on the appliance filesystem. Second, a GET request to a separate vulnerable path triggers execution of the dropped payload. The payload runs as the NetScaler process user, effectively root. This two-step write-then-execute chain was published as working proof-of-concept code within two weeks of the advisory, before patches existed for most affected versions.

CISA confirmed that Iranian nation-state actors (Fox Kitten / Phosphorus) were among the first to exploit CVE-2019-19781 at scale, targeting US government agencies, defense contractors, and critical infrastructure organizations for persistent access. Chinese and Russian APT groups were also confirmed exploiting the vulnerability. Ransomware operators used the initial access to plant persistence, web shells and backdoor accounts, that they later activated for ransomware deployment.

The exploitation window before patches arrived was particularly damaging because automated scanners could extract configuration data, session tokens, and credentials from thousands of devices simultaneously. Credentials harvested during this period remained valid long after devices were patched, enabling continued unauthorized access through the legitimate VPN infrastructure.

Citrix released patches in January–February 2020. If any device ran vulnerable firmware in an internet-accessible state, the remediation has three mandatory components: patch, credential rotation, and compromise investigation.