CVSS 9.8 CRITICAL Bulletin: CTX267027 Published: 2019-12-27

CVE-2019-19781: Citrix ADC & Gateway Directory Traversal Remote Code Execution (Shitrix)

Technical intelligence and weaponization dossier for CVE-2019-19781. Documented exploitation across 3 active malware families totaling 628 analyzed telemetry samples.

Attributed Families

Sample Volume

628

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2019-19781
Common Name / Bulletin	Citrix ADC & Gateway Directory Traversal Remote Code Execution (Shitrix) (`CTX267027`)
CWE Classification	`CWE-22: Path Traversal in NetScaler VPN Handler`
Affected Software & Versions	Citrix ADC and NetScaler Gateway versions 10.5 through 13.0
Technical Root Cause	Path traversal in VPN handler (/vpn/../vpns/cfg/smb.conf) coupled with Perl template processing (/vpns/portal/scripts/newbm.pl), allowing arbitrary command execution on the appliance.
Associated ATT&CK Techniques	`T1190` — Associated ATT&CK Technique `T1059` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2019-19781

Empirical catalog telemetry verifies that the following 3 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

3 families

Malware Family	Category	Catalog Samples	Operational Profile
trickbot	Trojan	`466`	TrickBot (often dubbed Trickloader or Totep) is one of the most prolific and dangerous modular trojans and enterprise access vectors in modern cybercrime histor...
revil	Ransomware	`160`	REvil (also universally known as Sodinokibi and Sodin) was one of the most prolific and technically sophisticated Ransomware-as-a-Service (RaaS) cartels in cybe...
winnti	Backdoor	`2`	Backdoor:Win32/Winnti is the flagship modular cyber espionage platform and kernel rootkit family utilized by Chinese state-nexus threat group APT41 (also tracke...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2019-19781 in enterprise intrusions and campaign toolkits:

APT41 — Attributed Threat Group / Campaign Operator
Chinese MSS — Attributed Threat Group / Campaign Operator
Winnti Group — Attributed Threat Group / Campaign Operator
Wizard Spider — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2019-19781 in enterprise networks:

Web server access logs containing HTTP requests matching /vpn/../vpns/ or POST requests to /vpns/portal/scripts/newbm.pl with NSC_USER headers.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Apply Citrix CTX267027 firmware updates; configure responder policies blocking URL patterns containing /../ or /vpns/.

For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →

← Return to Vulnerability Matrix Directory (All 63 CVEs)