erroneo.us
Search all guides⌘K

Security Digest · Oct 10, 2023 · Vulnerability · Network edge

Citrix Bleed: NetScaler Gateway Leaks Session Tokens

CVE-2023-4966 leaks NetScaler AAA session cookies, bypassing MFA; ransomware used it. Patch to 14.1-8.50/13.1-49.15+ and kill all sessions.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Act now

If a NetScaler configured as a Gateway or AAA server is still on a vulnerable build, assume it is being probed and patch, kill every session, and hunt; patching alone does not evict an attacker holding a stolen session.

Who must act: Every organization running customer-managed NetScaler ADC or Gateway as a VPN, ICA Proxy, CVPN, RDP Proxy or AAA virtual server, especially on end-of-life 12.1 or 13.0 builds.

Who can relax: Users of Citrix-managed cloud services and Citrix-managed Adaptive Authentication, and appliances not configured as a Gateway or AAA virtual server.

Affected
NetScaler ADC and Gateway 14.1 before 14.1-8.50
13.1 before 13.1-49.15
13.0 before 13.0-92.19
NetScaler ADC 13.1-FIPS before 13.1-37.164
12.1-FIPS and 12.1-NDcPP before 12.1-55.300
12.1 (end-of-life, vulnerable)
Fixed in
14.1-8.50 and later
13.1-49.15 and later
13.0-92.19 and later
13.1-FIPS 13.1-37.164 and later
12.1-FIPS / 12.1-NDcPP 12.1-55.300 and later
CVSS
9.4 (v3.1, CNA)
EPSS
100.0% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Confirm the build with `show version` and upgrade to a fixed release; move off end-of-life 12.1 and 13.0 trains.
  2. Immediately after upgrading run: `kill icaconnection -all`, `kill rdp connection -all`, `kill pcoipConnection -all`, `kill aaa session -all`, `clear lb persistentSessions`.
  3. If you cannot patch at once, isolate the appliance from the internet as CISA advised.
  4. Rotate credentials for identities that used the appliance during the exposure window.
  5. Hunt for post-exploitation activity behind the gateway using the indicators in CISA AA23-325A.

How to check if you are affected or compromised

  • Search WAF or network logs for GET requests to `/oauth/idp/.well-known/openid-configuration` with unusually long Host headers; NetScaler itself does not log these.
  • In ns.log TCPCONNSTAT events, flag sessions where Client_ip and Source differ, or one IP uses many accounts in a short window.
  • Check users for logins from multiple public IPs or unexpected regions, and new accounts or remote tools (PuTTY, rclone) on internal hosts.
  • If preserving evidence, take NSPPE core dumps before rebooting and look for very long strings of '0' characters.

What happened#

On October 10, 2023, Citrix (Cloud Software Group) published bulletin CTX579459 fixing CVE-2023-4966, a sensitive information disclosure, and CVE-2023-4967, a denial of service, in NetScaler ADC and NetScaler Gateway. The disclosure bug became known as "Citrix Bleed." Citrix scores it CVSS 9.4; NVD scores it 7.5 because it rates only confidentiality impact. In practice the leak is worse than a typical information disclosure.

Assetnote's analysis, published October 24, traced it to unauthenticated OpenID configuration endpoints that build a response from the attacker-supplied Host header. The code trusted the return value of snprintf as the number of bytes written, so a long Host header made the appliance send back memory past a 0x20000-byte buffer. Mandiant found that leaked memory can include a valid AAA session cookie issued after authentication, including MFA. Replaying it gives an attacker an authenticated session with no password or MFA token.

Mandiant saw zero-day exploitation starting in late August 2023. Citrix added exploitation reports to its bulletin on October 17; CISA listed it in the KEV catalog on October 18, flagged for known ransomware use, and it remains there as of this writing. In November, CISA advisory AA23-325A described LockBit 3.0 affiliates using it against organizations across education, energy, finance, government, healthcare and transportation.

Who is affected#

Customer-managed appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, on builds before 14.1-8.50, 13.1-49.15, 13.0-92.19, 13.1-FIPS 13.1-37.164, or 12.1-FIPS/NDcPP 12.1-55.300. Version 12.1 is end-of-life and also vulnerable. Citrix-managed cloud services need no action.

Do you really need to act?#

Yes, if you run one of these as an internet-facing gateway, which is the usual purpose of the configuration. Exploitation needs no credentials, works with a single crafted GET request, and public analysis has been available since October 2023. The trap that caught many organizations: patching does not invalidate sessions that were already stolen. Citrix's follow-up post told customers to kill all active and persistent sessions after upgrading. If you patched without doing that during the exploitation window, treat the gap as a possible compromise. Appliances used only as plain load balancers, without Gateway or AAA, are outside the stated preconditions.

What to do now#

  1. Run show version and upgrade to a fixed build; leave end-of-life trains.
  2. Right after upgrading, run kill icaconnection -all, kill rdp connection -all, kill pcoipConnection -all, kill aaa session -all and clear lb persistentSessions.
  3. If you cannot patch now, isolate the appliance from the internet, per CISA.
  4. Rotate credentials for accounts that used the gateway during exposure.
  5. Hunt behind the gateway for lateral movement using CISA's indicators.

How to tell if you were hit#

NetScaler does not log requests to the vulnerable endpoint, so Mandiant recommends checking WAF or network logs for GETs to /oauth/idp/.well-known/openid-configuration with abnormally long Host headers. In ns.log, look at TCPCONNSTAT events where Client_ip and Source differ, or one IP using many accounts quickly. Default log rotation keeps only about 2.5 MB, so check syslog forwarding. CISA adds signs downstream: new accounts, remote tools such as PuTTY or rclone, and logins from unexpected regions. Core dumps can show attempts but cannot tell failed from successful ones.

Timeline#

  • — Mandiant observes zero-day exploitation.
  • — Citrix bulletin CTX579459 and fixed builds released.
  • — Citrix updates bulletin with exploitation reports.
  • — CISA adds CVE-2023-4966 to KEV.
  • — NetScaler publishes session-kill guidance.
  • — Assetnote publishes root-cause analysis.
  • — CISA advisory AA23-325A on LockBit 3.0 exploitation.

Vulnerability records

  • CVE-2023-4966 · KEV 2023-10-18 · Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA…
  • CVE-2023-4967 · Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA Virtual Server

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Citrix — NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-4966 and CVE-2023-4967 (CTX579459) support.citrix.com
  2. NetScaler — CVE-2023-4966: Critical security update now available netscaler.com
  3. NVD — CVE-2023-4966 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities Catalog cisa.gov
  5. CISA — AA23-325A: LockBit 3.0 Ransomware Affiliates Exploit CVE-2023-4966 Citrix Bleed cisa.gov
  6. Mandiant (Google Cloud) — Session Hijacking via Citrix NetScaler CVE-2023-4966 cloud.google.com
  7. Searchlight Cyber (Assetnote) — Citrix Bleed: Leaking Session Tokens with CVE-2023-4966 slcyber.io