NexurAI
The internet-facing gateways attackers pop first: VPNs, load balancers and remote-access boxes.
A path-traversal flaw in Citrix ADC allows unauthenticated remote code execution on the appliance - a favorite ransomware entry point.
Citrix ADC / Gateway (NetScaler) · 2019
The attacker uses '/vpn/../vpns/' path traversal to reach a vulnerable template endpoint and write/execute a payload, gaining code execution on the appliance.
Alert on requests containing '/vpn/../vpns/' or to /vpns/portal/scripts/, new .xml/.pl files in the template dir, and unexpected processes on the appliance.
Patch the appliance, apply Citrix's mitigation, and forensically review for implants (appliances are often not re-imaged).
A path traversal in the FortiOS SSL VPN portal leaks system files - including plaintext VPN credentials - to unauthenticated attackers.
Fortinet FortiOS SSL VPN · 2018
The attacker requests a crafted URL to read the sslvpn session file, harvesting usernames and passwords, then logs into the VPN as a real user.
Alert on requests to /remote/fgt_lang?lang=/../ or sslvpn_websession reads, and on VPN logins that follow from new IPs shortly after.
Patch FortiOS, then reset ALL VPN credentials (leaked creds persist after patching), and enforce MFA on the VPN.
An authentication bypass in the iControl REST interface lets an unauthenticated attacker run arbitrary system commands as root on BIG-IP.
F5 BIG-IP (iControl REST auth bypass) · 2022
The attacker abuses the hop-by-hop header / auth bypass to reach the REST 'bash' endpoint and execute commands as root.
Alert on POSTs to /mgmt/tm/util/bash with X-F5-Auth-Token/Connection header anomalies, and unexpected commands run by the REST service.
Patch, restrict management access to a trusted network, and review for post-exploitation on the device.
A buffer over-read leaks session tokens from NetScaler memory, letting attackers hijack authenticated sessions and bypass MFA.
Citrix NetScaler ADC / Gateway · 2023
The attacker sends a crafted request to over-read memory, harvests valid session cookies, and replays them to impersonate users without credentials or MFA.
Hunt for session reuse from new IPs/user-agents, impossible-travel logins, and large or malformed requests to the NetScaler; correlate with VPN session anomalies.
Patch NetScaler, then terminate ALL active sessions (patching alone does not evict stolen tokens), and review for post-exploitation activity.
An unauthenticated arbitrary file read on Pulse Secure VPN leaks system files - including plaintext credentials and session data.
Pulse Connect Secure SSL VPN · 2019
The attacker requests a crafted path to read arbitrary files, harvesting cached credentials and session tokens, then logs in as legitimate users (bypassing MFA via stolen sessions).
Alert on path-traversal-style requests to the VPN, session reuse from new IPs, and impossible-travel logins; review VPN logs for anomalous access.
Patch, then reset ALL VPN credentials and terminate sessions (leaked creds/sessions persist after patching), and enforce MFA.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.