Citrix NetScaler CVE-2019-19781 Attempted Exploitation via Web Requests
Flags suspicious NetScaler HTTP URIs containing traversal-style /vpns/ portal script or config file references.
- Category
- webserver
- Author
- Arnim Rupp, Florian Roth (SigmaHQ), DRL 1.1
- Published
- 2020-01-02
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies web requests targeting Citrix NetScaler-like endpoints with URL query patterns consistent with CVE-2019-19781 exploitation attempts. Attackers may use crafted traversal and script-path requests to reach vulnerable portal scripts. It relies on webserver telemetry, specifically the HTTP request URI query content and its presence of traversal-like paths and .pl script paths under the portal/scripts directory.
Reporting behind it
- support.citrix.comhttps://support.citrix.com/article/CTX267679
- support.citrix.comhttps://support.citrix.com/article/CTX267027
- isc.sans.eduhttps://isc.sans.edu/diary/25686
- twitter.comhttps://twitter.com/mpgn_x64/status/1216787131210829826
- github.comhttps://github.com/x1sec/CVE-2019-19781/blob/25f7ab97275b2d41800bb3414dac8ca3a78af7e5/CVE-2019-19781-DFIR.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-19781/web_cve_2019_19781_citrix_exploit.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Citrix NetScaler CVE-2019-19781 Attempted Exploitation via Web Requests
id: 263c5ba3-be3e-477a-8525-219ab2e3317b
status: test
description: This rule identifies web requests targeting Citrix NetScaler-like endpoints with URL query patterns consistent with CVE-2019-19781 exploitation attempts. Attackers may use crafted traversal and script-path requests to reach vulnerable portal scripts. It relies on webserver telemetry, specifically the HTTP request URI query content and its presence of traversal-like paths and .pl script paths under the portal/scripts directory.
references:
- https://support.citrix.com/article/CTX267679
- https://support.citrix.com/article/CTX267027
- https://isc.sans.edu/diary/25686
- https://twitter.com/mpgn_x64/status/1216787131210829826
- https://github.com/x1sec/CVE-2019-19781/blob/25f7ab97275b2d41800bb3414dac8ca3a78af7e5/CVE-2019-19781-DFIR.md
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-19781/web_cve_2019_19781_citrix_exploit.yml
author: Arnim Rupp, Florian Roth, Huntrule Team
date: 2020-01-02
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2019-19781
- detection.emerging-threats
logsource:
category: webserver
definition: Make sure that your Netscaler appliance logs all kinds of attacks (test with http://your-citrix-gw.net/robots.txt). The directory traversal with ../ might not be needed on certain cloud instances or for authenticated users, so we also check for direct paths. All scripts in portal/scripts are exploitable except logout.pl.
detection:
selection_cs:
- cs-uri-query|contains: /../vpns/
- cs-uri-query|endswith: /vpns/cfg/smb.conf
selection_csall:
cs-uri-query|contains|all:
- /vpns/portal/scripts/
- .pl
condition: 1 of selection_*
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: ac5a6409-8c89-44c2-8d64-668c29a2d756
type: derived