A buffer over-read in the OpenID configuration endpoint returns uninitialised memory when a long Host header is supplied. The leaked memory frequently contains valid session cookies for authenticated users.
Because the leaked token represents an already-authenticated session, MFA is bypassed entirely. Ransomware operators including LockBit used this to gain footholds in enterprise networks throughout late 2023.
Only appliances configured as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server are vulnerable.
Remediation
Upgrade to NetScaler ADC and Gateway 14.1-8.50, 13.1-49.15, 13.0-92.19 or later.
After patching, kill all active and persistent sessions: kill icaconnection -all, kill rdp connection -all, kill pcoipConnection -all, kill aaa session -all, clear lb persistentSessions.
Hunt for sessions where the source IP changed mid-session or where a single user held multiple simultaneous sessions from different networks.
Enumeration
Detection templates and scanners you can run to find exposed instances on your own attack surface.
Metasploit
auxiliary/scanner/http/citrix_bleed_cve_2023_4966
$ msfconsole -q -x "use auxiliary/scanner/http/citrix_bleed_cve_2023_4966; show options"
Scanner
Nuclei
http/cves/2023/CVE-2023-4966.yaml
$ nuclei -id CVE-2023-4966 -u https://TARGET
Detection
Exploitation
Working exploit modules and public PoCs. Use only against systems you own or are authorized to test.
