Sensitive Information Disclosure in NetScaler ADC and NetScaler Gateway
CVE-2023-4966

7.5HIGH

Key Information:

Vendor
Citrix
Status
Netscaler Adc
Netscaler Gateway
Vendor
CVE Published:
10 October 2023

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 95%🦅 CISA Reported📰 News Worthy

Summary

A vulnerability has been identified in Citrix NetScaler ADC and Gateway that allows for the potential disclosure of sensitive information. This issue arises when the products are configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. Attackers could exploit this vulnerability to gain unauthorized access to sensitive user data, which may lead to further exploitation of affected systems.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.

Affected Version(s)

NetScaler ADC 14.1 < 8.50

NetScaler ADC 13.1 < 49.15

NetScaler ADC 13.0 < 92.19

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-4966
Created by Chocapikk

citrix_cve-2023-4966
Created by dinosn

CVE-2023-4966
Created by sanjai-AK47

News Articles

favicon imageGBHackers News

Citrix Bleed: PoC Released Citrix NetScaler Zero-Day Vulnerability

Two vulnerabilities were disclosed by Citrix Bleed which were CVE-2023-4966 and CVE-2023-4967 with critical and high severities respectively.

favicon imagePalo Alto Networks

Threat Brief: Citrix Bleed CVE-2023-4966

Threat brief on CVE-2023-4966 (aka Citrix Bleed) affecting multiple Netscaler products covers attack scope, threat hunting queries and interim guidance.

favicon imageDark Reading

Citrix Discovers Two Vulnerabilities, Both Exploited in the Wild

These vulnerabilities are the second and third for Citrix but are not expected to be as detrimental as &quot;CitrixBleed.&quot;

References

https://support.citrix.com/article/CTX579459
http://packetstormsecurity.com/files/175323/Citrix-Bleed-...

EPSS Score

95% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 📰

    First article discovered by The Cyber Express

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.