Monday briefing: Active exploits hit OpenSSH regreSSHion and lingering Citrix Bleed exposures
Marcus Webb ·
Threat actors continue to target two widely exposed entry points on Monday, the OpenSSH regreSSHion flaw tracked as CVE-2024-6387 and residual Citrix Bleed exposures tracked as CVE-2023-4966. Attackers are probing internet facing Linux hosts and Citrix ADC and Gateway appliances to gain initial access, then pivoting inside networks for data theft or ransomware deployment.
This matters because both bugs impact high value perimeter services and remain present in many environments. Exploitation requires no authentication in common configurations, and public proof of concept code and scanning infrastructure are widely available.
Active exploits and entry vectors
CVE-2024-6387 is a signal handler race condition in sshd that can allow unauthenticated remote code execution on glibc based Linux systems. It affects portable OpenSSH releases from 8.5p1 through 9.8p1 when built with default settings. Upgrading to a vendor build that includes the upstream fix or setting LoginGraceTime to 0 as a temporary mitigation reduces risk, though the mitigation has operational trade offs.
CVE-2023-4966, known as Citrix Bleed, allows theft of session tokens from vulnerable NetScaler ADC and Gateway appliances. Even in environments that applied firmware updates, unexpired stolen sessions and webshells planted before patching have enabled follow on access. Past intrusions linked to this bug have been used by ransomware affiliates and data theft crews.
Edge appliance compromises from earlier Ivanti Connect Secure zero days also continue to haunt networks. If appliances were not rebuilt from clean media and all credentials and tokens rotated, actors may still have backdoors or SSO tokens that bypass authentication.
What security teams should do now
Inventory and patch internet reachable SSH servers to an OpenSSH build that contains the fix for CVE-2024-6387. Where patching is not immediate, restrict SSH to known management ranges, enforce key based auth, enable connection rate limiting, and consider setting LoginGraceTime to 0 until maintenance windows allow upgrades.
Validate Citrix ADC and Gateway firmware versions against vendor advisories for CVE-2023-4966. Invalidate all sessions, rotate SSO secrets and admin credentials, and review for indicators of compromise, including unusual rewrite policies, unknown responder policies, and suspicious files under /var.
Hunt for persistence left by earlier appliance exploits. Reimage affected devices, rotate identity provider signing keys and API tokens, and review outbound traffic for new C2 domains or unexpected DNS. Limit blast radius by placing management interfaces behind dedicated access controls and enforcing phishing resistant MFA.
The broader security takeaway is that perimeter services and identity gateways remain reliable initial access vectors when misconfigured or lagging on updates. Programs that couple rapid patching and hardening with rigorous session and token hygiene reduce the Monday morning advantage attackers expect.