Exploit for Use of Uninitialized Variable in Citrix Netscaler_Application_Delivery_Controller CVE-2025-5777

## https://sploitus.com/exploit?id=53F7502A-7C69-5A7A-8481-DD970FF74FF5
# CVE-2025-5777 — CitrixBleed 2 (Citrix NetScaler Memory Disclosure)

**CVSS 9.3 — Critical — Active exploitation in the wild**

CitrixBleed 2 is a memory disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Insufficient input validation in the authentication endpoint causes a **memory overread (CWE-125)**, allowing an unauthenticated attacker to leak sensitive memory contents — including session cookies, cryptographic material, and other secrets.

## Overview

| Field | Value |
|-------|-------|
| **CVE** | CVE-2025-5777 |
| **CVSS** | 9.3 (Critical) |
| **CWE** | 125 — Out-of-bounds Read |
| **Affected** | NetScaler ADC / Gateway (specific versions below) |
| **Exploitation** | Confirmed in the wild |
| **Discovered** | 2025 |
| **Type** | Memory Disclosure / Information Leak |

## Technical Details

The vulnerability resides in the authentication endpoint:

```
POST /p/u/doAuthentication.do
```

By sending a request with an **empty `login` parameter**, the server's input validation is bypassed, causing it to copy uninitialized memory into the response. The leaked data appears inside `` XML elements in the HTTP response.

An attacker can chain the memory leak with a session-hijacking attack by extracting `NSC_AAAC` session cookies from the leaked memory.

### What is leaked

- Session cookies (`NSC_AAAC`, `NSC_TEMP`, etc.)
- Internal IP addresses
- Stack / heap fragments
- Cryptographic key material (observed in some leaks)
- Other users' session tokens

## Affected Versions

| Product | Vulnerable | Fixed |
|---------|-----------|-------|
| NetScaler ADC 14.1 | ` element values.
5. Inspect leaked data for session cookies and other secrets.
6. If an `NSC_AAAC` cookie is found, use it to impersonate the victim session.

## PoC

```http
POST /p/u/doAuthentication.do HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded

login=&passwd=foo
```

The response will contain `` tags with leaked memory contents. On a patched system, `` should simply be empty.

## Mitigation

1. **Upgrade** to the patched firmware version listed above.
2. **Invalidate all active sessions** after patching to ensure any leaked tokens are no longer valid.
3. Where immediate patching is not possible, restrict access to the management interface and authentication endpoints via ACLs or WAF rules.
4. Monitor for signs of exploitation — unexpected requests to `/p/u/doAuthentication.do` with empty parameters.

## References

- Citrix Security Advisory: https://support.citrix.com/article/CTX691608
- CVE Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-5777
- NVD: https://nvd.nist.gov/