Citrix plans to push out patches by the end of the month for a serious flaw that it admits hackers may already be targeting.
Last month, Citrix acknowledged that Citrix Gateway and Citrix Application Delivery Controller were at risk because of a critical vulnerability, after the flaw was spotted by Positive Technologies.
Citrix admitted that the bug could allow attackers to run code on companies' local networks by taking advantage of apps they published using the systems. At the time, Positive Technologies estimated as many as 80,000 companies in 158 countries could be at risk, including the UK and US.
"Depending on specific configuration, Citrix applications can be used for connecting to workstations and critical business systems (including ERP)," the security firm said at the time. "In almost every case, Citrix applications are accessible on the company network perimeter, and are therefore the first to be attacked. This vulnerability allows any unauthorised attacker to not only access published applications, but also attack other resources of the company's internal network from the Citrix server."
Reports now suggest hackers are already looking to make use of the flaw, with security firm Bad Packets reporting exploit attempts against its honeypots, systems set up to attract attention from criminals. Its scans suggested more than 2,000 servers were vulnerable in the UK as of today. Other researchers have also reported exploit attempts, with a working exploit shared on GitHub.
"There have been reports of network scanning to detect the presence of this vulnerability," Fermin J. Serna, chief information security officer at Citrix, admitted in a blog post this weekend.
However, the company doesn't believe most of its users will be at risk. "As many deployments are behind the firewall, we believe that a limited number of devices are exploitable," Serna said, adding that it recommended following the previously released mitigation advice.
That will have to do until Citrix releases its patches, which will begin to rollout 20 January but could take until the end of the month to complete depending on system version. "As with any product of this nature, and consistent with our policies and procedures, these fixes need to be comprehensive and thoroughly tested," Serna added.
Last year, Citrix's own systems were targeted, leaking 6TB of data.
