Patching CitrixBleed isn’t enough; organizations need to invalidate active or persistent session tokens as the these tokens can be used to compromise networks and bypass authentication measures including multifactor authentication

CVE-2023-4966 (CitrixBleed): Invalidate Active or Persistent Sessions To Prevent Further Compromise

Frequently asked questions relating to a critical vulnerability in Citrix NetScaler that has been under active exploitation for over a month, including by ransomware groups.

Frequently Asked Questions for CitrixBleed (CVE-2023-4966)

A critical information disclosure vulnerability in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway has been exploited in the wild as a zero-day vulnerability. Organizations are urged to patch immediately.

CVE-2023-4966: Citrix NetScaler ADC and NetScaler Gateway Information Disclosure Exploited in the Wild

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.

The version of Citrix ADC or Citrix NetScaler Gateway SSL VPN running on the remote web server is affected by an information disclosure vulnerability. An unathenticated, remote attacker can send a request to the device, causing a buffer overflow and revealing secrets, including session tokens, from the application memory.

Please refer to advisory CTX579459 for more information.

Citrix ADC and Gateway 13.0-x < 13.0-92.19, 13.1-x < 13.1-49.15, 14.1-x < 14.1-8.50, and ADC (FIPS/NDcPP) 12.1-x < 12.1-55.300 suffer from a Sensitive Information Disclosure. By crafting a specific query, a remote and unauthenticated attacker can leverage this vulnerability to obtain a valid session token.

The remote NetScaler ADC (formerly Citrix ADC) or NetScaler Gateway (formerly Citrix Gateway) device is version 12.1, 12.1-FIPS before 12.1-55.300-FIPS, 13.0 before 13.0-92.19, 13.1 before 13.1-49.15, 13.1-FIPS before 13.1-37.164-FIPS, or 14.1 before 14.1.8.50. It is therefore affected by multiple vulnerabilities:

  - Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN     virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. (CVE-2023-4966)

  - Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server,     ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. (CVE-2023-4967)

Please refer to advisory CTX579459 for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186176	Citrix ADC and Citrix NetScaler Gateway Information Disclosure (CTX579459) (Direct Check)	Nessus	CGI abuses	high
114100	Citrix Gateway / ADC Sensitive Information Exposure	Web App Scanning	Component Vulnerability	high
183026	NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX579459)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2023-4966

high

Tenable Plugins

high

high

high