Citrix gateways: the most exposed system in the hospital

The week

In December 2019, Citrix disclosed a critical vulnerability (CVE-2019-19781) in its Application Delivery Controller and Gateway products, which many organizations use to give remote users access to internal applications. Citrix published configuration mitigations but no patch at first. In the second week of January 2020, public exploit code appeared and attackers began scanning for and compromising unmitigated devices. Citrix released its first permanent fixes on January 19 and completed fixes for the remaining supported versions by January 24. Government cyber agencies in several countries urged organizations to apply mitigations or fixes immediately and to check whether devices had already been compromised. Patching alone would not remove an intruder who had got in first.

Hospitals use Citrix and similar gateways for good reasons. They let clinicians, coders and affiliated physicians reach the electronic health record and other clinical applications from outside the building without installing those applications locally. The January 2020 vulnerability exposed four architectural problems with that arrangement, each calling for a different decision. The gateway is the most exposed system in the building. It is one door to many rooms. Patching it does not prove it is clean. And an estate that funnels remote work through a single gateway needs a plan for what replaces it.

The most exposed system in the building

A remote-access gateway must be reachable from the internet. That makes it the first thing attackers scan for and the first thing they try when a flaw is published. In January 2020, the gap between public exploit code and widespread compromise attempts was a matter of days.

In many hospitals, these devices belonged to a network team, had been configured years earlier and were treated as plumbing rather than as an application with its own patch cycle. Firmware updates required a maintenance window that clinical leaders were reluctant to grant, because the gateway carried after-hours access for physicians. The result was devices that ran old code for long periods.

The design response is to treat internet-facing access devices as a distinct asset class. That means an inventory of every such device, including forgotten test units, and a named owner with authority to schedule emergency maintenance. It also means an emergency patch procedure agreed in advance with clinical leadership, and a redundant pair so one unit can be patched while the other carries traffic. Monitoring should not depend on the device itself, since a compromised device can lie about its own state.

One door to many rooms

Gateways are valuable because they aggregate. A single sign-in presents a menu of clinical and business applications. For an attacker, the same aggregation means one compromised device can open a path to the EHR, file shares and administrative systems, depending on how the network behind it is built. Many hospital networks were flat, on the assumption that anyone inside was trusted.

The alternative is to separate what the gateway can reach. Clinical applications, administrative systems and medical device networks should sit in different zones, with the gateway allowed to talk only to the published application servers it fronts. Segmentation in hospitals is slow, because clinical workflows cross boundaries constantly and medical devices often cannot be readdressed easily. It is also the control that limits how bad a bad day gets.

The same logic applies to the accounts the gateway trusts. Remote access usually rests on directory credentials that also unlock email, file shares and sometimes administrative tools. Multi-factor authentication at the gateway helps, but only if those credentials cannot be reused elsewhere without it. Third-party users, such as billing vendors, affiliated practices and device manufacturers’ support staff, need particular care, because their accounts are often provisioned generously and reviewed rarely.

Patching it does not prove it is clean

Citrix’s fixes closed the hole. They did not remove anything an attacker had already installed. Security agencies and researchers urged organizations to look for signs of prior compromise, and Citrix and others published tools to help. Many organizations patched and moved on, because compromise assessment needs skills and time that hospital IT teams rarely have in a normal week.

A sound playbook for edge devices has two steps: fix, then hunt. The hunt looks for unexpected files on the device, new accounts, unusual outbound connections and sign-ins that do not match known users. It depends on logs that were shipped off the device before the incident and kept long enough to cover the exposure window, so log retention for edge devices belongs in the design. The hunt can be outsourced, but the contract should be signed in advance, so the hospital is not negotiating terms while an intruder may still be inside.

What should replace a single gateway

The longer-term question is whether one gateway should carry so much weight. Approaches that check the user, the device and the request for each application, rather than admitting a user to a network, reduce the value of any single device to an attacker. They are not a quick swap. They need a mature identity platform, management of the laptops and tablets clinicians actually use, and application owners willing to change how access is granted.

A realistic sequence for a health system has three stages. First, harden and monitor the gateway it has. Second, segment what sits behind it. Third, move applications to identity-centric access one at a time, starting with those that hold the most sensitive data or are most often used by third parties. Each stage reduces risk on its own, so the program delivers value even if later stages slip.

Funding is the usual obstacle. Gateways sit in infrastructure budgets, while identity and segmentation work competes with clinical system projects for the same small teams. Framing the program as shrinking what the hospital’s most exposed device can reach gives finance and clinical leaders something concrete to weigh. A measurable target helps, such as the number of applications reachable through any single access path.

With hindsight

Within two months, for many hospitals, the gateway went from one remote-access path among several to the main route into clinical systems, as non-clinical work moved home during the pandemic. Devices patched in a hurry in January suddenly carried most of the load. In September 2020, Germany’s federal cyber agency, the BSI, said a ransomware attack that disrupted Düsseldorf University Hospital had used this same Citrix flaw, with backdoors installed before the hospital applied the fix.

Edge devices remained a leading way in for attackers. In late 2023 another Citrix vulnerability, known as Citrix Bleed, was widely exploited, and the 2024 attack on Change Healthcare was described in congressional testimony as starting through a remote-access portal without multi-factor authentication. The sequence from January 2020 held up: patch fast, assume compromise until a hunt says otherwise, and reduce how much any single gateway can open.