NetScaler WAF Signatures Update v128
NetScaler has released a new version of its integrated Web App Firewall signatures to help customers mitigate several CVEs with variable CVSS.
A notable CVE with 10.0 score is CVE-2024-4040 which is a server-side template injection vulnerability in CrushFTP, a popular file transfer server software. This vulnerability affects all versions of CrushFTP before 10.7.1 and 11.1.0 on all platforms. The flaw allows unauthenticated remote attackers to exploit the Virtual File System (VFS) sandbox, enabling them to read files from the filesystem outside of the sandbox. By bypassing authentication, attackers gain unauthorized access to sensitive files and can potentially execute code on the server. To mitigate this risk, it’s crucial to promptly update CrushFTP to the patched versions, restrict access to the server, monitor logs for suspicious activity, enforce strong authentication mechanisms, and follow general security best practices.
Signatures included in v128:
Signature rule |
CVE ID |
Description |
998498 |
CVE-2024-4040 |
WEB-MISC CrushFTP Prior to 10.7.1 and 11.1.0 - Server Side Template Injection Vulnerability (CVE-2024-4040) |
998499 |
CVE-2024-30162 |
WEB-MISC Invision Community - Arbitrary File Upload Vulnerability (CVE-2024-30162) |
998500 |
CVE-2024-23538, CVE-2024-23539 |
WEB-MISC Apache Fineract Prior to 1.9 - SQL Injection Vulnerabilities (CVE-2024-23538,CVE-2024-23539) |
998501 |
CVE-2024-23538, CVE-2024-23539 |
WEB-MISC Apache Fineract Prior to 1.9 - SQL Injection Vulnerabilities (CVE-2024-23538,CVE-2024-23539) |
998502 |
CVE-2024-20767 |
WEB-MISC Adobe ColdFusion Multiple Versions - Improper Access Control Vulnerability (CVE-2024-20767) |
998503 |
CVE-2024-1981 |
WEB-WORDPRESS WordPress Plugin WPVivid Backup & Migration - SQLi Vulnerability (CVE-2024-1981) |
998504 |
CVE-2023-6019 |
WEB-MISC Anyscale Ray - OS Command Injection Vulnerability (CVE-2023-6019) |
998505 |
CVE-2023-44092 |
WEB-MISC Pandora FMS Prior to 776 - Remote Code Execution Vulnerability (CVE-2023-44092) |
998506 |
CVE-2023-40000 |
WEB-WORDPRESS LiteSpeed Cache Prior To 5.7.0.1 - Stored Cross Site Scripting Vulnerability (CVE-2023-40000) |
998507 |
CVE-2023-40000 |
WEB-WORDPRESS LiteSpeed Cache Prior To 5.7.0.1 - Stored Cross Site Scripting Vulnerability (CVE-2023-40000) |
998508 |
CVE-2023-37679, CVE-2023-43208 |
WEB-MISC NextGen Mirth Connect < 4.4.1 - Unauthenticated RCE Vulnerability Via /server (CVE-2023-37679, CVE-2023-43208) |
998509 |
CVE-2023-37679, CVE-2023-43208 |
WEB-MISC NextGen Mirth Connect < 4.4.1 - Unauthenticated RCE Vulnerability Via /users (CVE-2023-37679, CVE-2023-43208) |
998510 |
CVE-2023-25196 |
WEB-MISC Apache Fineract Prior to 1.8.4 - SQL Injection Vulnerabilities (CVE-2023-25196) |
998511 |
CVE-2023-25195 |
WEB-MISC Apache Fineract Prior to 1.8.4 - Server-Side Request Forgery Vulnerability (CVE-2023-25195) |
NetScaler customers can quickly import the above signatures to help reduce risk and lower exposure associated with these vulnerabilities. Signatures are compatible with NetScaler (formerly Citrix ADC) software version 11.1, 12.0, 12.1, 13.0 and 13.1. NOTE: Software versions 11.1 and 12.0 are end of life, and you should consider upgrading for continued support. Learn more about the NetScaler software release lifecycle.
If you are already using NetScaler Web App Firewall with the signature auto-update feature enabled, verify that your signature file version is 128 or later and then follow these steps.
- Search your signatures for <number>
- Select the results with ID
- Choose “Enable Rules” and click OK
NetScaler WAF Best Practices
NetScaler recommends that WAF users always download the latest signature version, enable signature auto-update, and subscribe to receive signature alert notifications. NetScaler will continue to monitor this dynamic situation and provide updates as new mitigations become available.
Handling false positives
If app availability is affected by false positives that result from the above mitigation policies, relaxations can be applied. NetScaler recommends the following modifications to the policy.
Modifications to NetScaler Web App Firewall Policy:
add policy patset exception_list
# (Example: bind policy patset exception_list “/exception_url”)
Prepend the existing WAF policy with:
HTTP.REQ.URL.CONTAINS_ANY(“exception_list”).NOT
# (Example : set appfw policy my_WAF_policy q^HTTP.REQ.URL.CONTAINS_ANY(“exception_list”).NOT && <existing rule>^
NOTE: Any endpoint covered by the exception_list may expose those assets to risks
Additional Information
NetScaler Web App Firewall benefits from a single code base across all its form-factors (physical, virtual, bare-metal, and containers). This signature update applies to all form factors and deployment models of NetScaler Web App Firewall.
Learn more about NetScaler Web app Firewall, read our alert articles and bot signature articles to learn more about NetScaler WAF signatures, and find out how you can receive signature alert notifications.
Please join the NetScaler Community today and engage with your peers to learn more about how they are protecting their businesses with NetScaler WAF.
Recommended Comments
There are no comments to display.
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now