Vulnerabilities
Confirm Citrix builds exposed to CVE-2023-3519
Version-based detection of Citrix builds exposed to CVE-2023-3519.
Python · MIT license
overview
What cve-2023-3519-inspector does
Sits after a prober that has already surfaced Citrix Gateway or Netscaler hosts. The inspector fingerprints each appliance and reports whether the build falls in a CVE-2023-3519-vulnerable range.
Takes --url for a single gateway or --file for a list. It requests /vpn/pluginlist.xml, confirms the host via title and vhashes, and maps the Netscaler build to patched or vulnerable.
Unlike nuclei templates that cover many CVE classes, this node is a single-CVE version read. It does not send an exploit payload, so a miss is a misread build, not a crash on a production edge device.
use cases
Where cve-2023-3519-inspector fits
Detect CVE-2023-3519 exposure
Fingerprint a Citrix Gateway and report whether its build is vulnerable to the unauthenticated RCE, without launching the exploit against a production appliance.
Sweep a fleet of appliances
Pass a file of Citrix URLs to check every gateway in one run and produce a single list of which builds are exposed.
Confirm patch status
Re-run the inspector after patching to verify appliances now report a fixed build, closing the loop on remediation.
Prioritize edge assets
Route confirmed-vulnerable gateways to immediate triage, since they sit at the network edge and the flaw needs no authentication.
reference
cve-2023-3519-inspector inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | The URL of the Citrix Gateway to check. |
| file | FILE | --file | A file containing a list of URLs to check. |
Showing key inputs. cve-2023-3519-inspector exposes 2 inputs in total.
example
Run cve-2023-3519-inspector
# check a single Citrix Gateway
cve-2023-3519-inspector --url https://vpn.example.com
# sweep a fleet of gateways from a list of URLs
cve-2023-3519-inspector --file citrix-hosts.txt[*] Checking https://vpn.example.com
[+] Confirmed Citrix Gateway (title match, pluginlist.xml present)
[+] Detected Netscaler version: 13.1-48.47
[!] https://vpn.example.com is VULNERABLE to CVE-2023-3519
[*] Checking https://198.51.100.23
[+] Detected Netscaler version: 13.1-49.15
[-] https://198.51.100.23 is NOT vulnerable (patched build)
[*] Checking https://203.0.113.9
[-] https://203.0.113.9 does not appear to be a Citrix Gatewayguidance
Choosing cve-2023-3519-inspector
Run when you already have Citrix Netscaler or ADC endpoints and need to know which builds are exposed to CVE-2023-3519. Identify Citrix hosts first with a prober; keep nuclei for broader appliance coverage.
nuclei
Template-driven scanner with Citrix checks among many. Broader coverage, less version-precise on this CVE.
httpx
Probes and fingerprints hosts so you can hand Citrix endpoints to this inspector.
fingerprintx
Service fingerprinting that surfaces Citrix endpoints worth inspecting.
faq
cve-2023-3519-inspector questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run cve-2023-3519-inspector yourself
Hosts are probed by httpx to find Citrix endpoints, then the inspector fingerprints each for CVE-2023-3519 and writes the vulnerable appliances as output.
Facts on this page come from the live Trickest tool library.