A temporary shield for an unpatched Citrix flaw
Citrix has warned customers about a vulnerability in its Application Delivery Controller (ADC), also known as NetScaler. An attacker who exploits the flaw can bypass the administrator portal's login page without credentials and execute arbitrary code. No patch is currently available; Citrix expects fixes for some versions on January 20 and for others by the end of the month.
In the meantime, Citrix has asked customers to apply mitigation steps from an administrator command line. Those commands enforce new responder policies that return HTTP 403 responses when certain URL paths are requested. The vulnerability appears to stem from HTTP paths containing /vpn/../vpns/ via VPN or AAA endpoints, enabling a directory traversal attack that reaches directories normally behind the authentication flow.
Cloudflare offers a complementary layer of defense: placing the login page and administration interface behind Cloudflare Access, its identity proxy, so unauthenticated users can never reach the portal in the first place.
Blocking requests before they arrive
Citrix ADC is an application delivery controller providing Layer 3 through Layer 7 security for applications and APIs. Administrators manage their installation through a portal on a dedicated URL. To exploit the vulnerability, an attacker must first reach that login portal over HTTP or SSH.
Cloudflare Access, part of Cloudflare for Teams, protects internally managed resources by checking every request for identity and permission. When an application is secured behind Access, any request to its hostname stops at Cloudflare's network first. Access then checks the request against the list of users permitted to reach the application, so attackers cannot even submit a request to the vulnerable endpoints.
Closing the direct-IP hole
Deploying Access does not require opening new holes in corporate firewalls. Teams connect resources through Argo Tunnel, a secure outbound connection running in their infrastructure. The tunnel makes outbound-only calls to the Cloudflare network, allowing organizations to replace complex firewall rules with a single one: disable all inbound connections.
This is particularly useful against attackers who address IPs directly. With Argo Tunnel and firewall rules preventing inbound traffic, no request can reach those IPs without first hitting Cloudflare, where Access evaluates authentication and applies administrator-defined rules.
When users need to connect to protected tools—whether virtual machines, internal web applications like Jira, or other resources—they pass through Cloudflare, authenticate with their team's SSO, and are connected instantly. Every request to those tools is logged with identity information, giving administrators more visibility than a traditional VPN.
Layering defenses while waiting for the patch
Cloudflare Access can also be combined with the Cloudflare WAF, which has emergency-release rules to guard against the vulnerability. Adding Cloudflare Access, the WAF, and Citrix's recommended mitigation commands together creates a defense-in-depth posture while a patch is under development.
For Citrix ADC users who want to get started, the recommended approach is to place the ADC interface and exposed endpoints behind a bastion host secured by Cloudflare Access. On that host, administrators use Argo Tunnel to open outbound-only connections to Cloudflare through which HTTP and SSH requests can be proxied. Users connecting to the protected hostname are prompted to log in with their identity provider, and Cloudflare validates them against rules controlling who can reach the interface. No other requests will reach the interface over HTTP or SSH without authentication.
Cloudflare Access offers the first five seats free.
