CVE-2019-19781: Analyzing the Exploit

This report documents active exploitation of Citrix ADC/Gateway CVE-2019-19781: a directory traversal vulnerability enabling remote code execution. The author verified the exploit in AWS (obtaining an nsroot reverse shell), deployed a honeypot that observed heavy scanning and multiple exploit attempts (127,085 GETs in 48 hours, 249 exploitation attempts), and identified indicators including malicious curl URLs, many attacker IPs, and evidence of a cryptominer/backdoor. Mitigations and CISA/patch guidance are referenced.