loading
Loading content
loading
Vulnerabilities
Version-based detection of Citrix builds exposed to CVE-2023-3519.
overview
Sits after a prober that has already surfaced Citrix Gateway or Netscaler hosts. The inspector fingerprints each appliance and reports whether the build falls in a CVE-2023-3519-vulnerable range.
Takes --url for a single gateway or --file for a list. It requests /vpn/pluginlist.xml, confirms the host via title and vhashes, and maps the Netscaler build to patched or vulnerable.
Unlike nuclei templates that cover many CVE classes, this node is a single-CVE version read. It does not send an exploit payload, so a miss is a misread build, not a crash on a production edge device.
use cases
Fingerprint a Citrix Gateway and report whether its build is vulnerable to the unauthenticated RCE, without launching the exploit against a production appliance.
Pass a file of Citrix URLs to check every gateway in one run and produce a single list of which builds are exposed.
Re-run the inspector after patching to verify appliances now report a fixed build, closing the loop on remediation.
Route confirmed-vulnerable gateways to immediate triage, since they sit at the network edge and the flaw needs no authentication.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | The URL of the Citrix Gateway to check. |
| file | FILE | --file | A file containing a list of URLs to check. |
Showing key inputs. cve-2023-3519-inspector exposes 2 inputs in total.
example
# check a single Citrix Gatewaycve-2023-3519-inspector --url https://vpn.example.com # sweep a fleet of gateways from a list of URLscve-2023-3519-inspector --file citrix-hosts.txt[*] Checking https://vpn.example.com[+] Confirmed Citrix Gateway (title match, pluginlist.xml present)[+] Detected Netscaler version: 13.1-48.47[!] https://vpn.example.com is VULNERABLE to CVE-2023-3519[*] Checking https://198.51.100.23[+] Detected Netscaler version: 13.1-49.15[-] https://198.51.100.23 is NOT vulnerable (patched build)[*] Checking https://203.0.113.9[-] https://203.0.113.9 does not appear to be a Citrix Gatewayguidance
Run when you already have Citrix Netscaler or ADC endpoints and need to know which builds are exposed to CVE-2023-3519. Identify Citrix hosts first with a prober; keep nuclei for broader appliance coverage.
Template-driven scanner with Citrix checks among many. Broader coverage, less version-precise on this CVE.
Probes and fingerprints hosts so you can hand Citrix endpoints to this inspector.
Service fingerprinting that surfaces Citrix endpoints worth inspecting.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
Hosts are probed by httpx to find Citrix endpoints, then the inspector fingerprints each for CVE-2023-3519 and writes the vulnerable appliances as output.
Facts on this page come from the live Trickest tool library.