CVE-2025-12101 Scanner

Multi-threaded vulnerability scanner for CVE-2025-12101 - Citrix NetScaler XSS via SAML RelayState.

Overview

CVE-2025-12101 is a reflected XSS vulnerability in Citrix NetScaler ADC and Gateway products affecting the /cgi/logout endpoint through the RelayState parameter.

CVSS Score: 5.9 (Medium)

Features

• ✅ Single host (-u) or multiple hosts (-f) scanning
• ✅ Multi-threaded scanning (1-100 threads)
• ✅ Unique payload verification (zero false positives)
• ✅ Dual protocol testing (HTTP + HTTPS)
• ✅ Real-time progress bar
• ✅ CSV output with detailed results
• ✅ Proxy support (Burp Suite, OWASP ZAP)

Installation

# Clone repository
git clone https://github.com/boneys/CVE-2025-12101-Scanner.git
cd CVE-2025-12101-Scanner

# Install dependencies
pip3 install -r requirements.txt

Usage

# Scan single host
python3 CVE_2025-12101.py -u https://netscaler.example.com

# Scan from file
python3 CVE_2025-12101.py -f targets.txt -t 20

# Test both HTTP and HTTPS
python3 CVE_2025-12101.py -f targets.txt --both-protocols

# Scan through proxy
python3 CVE_2025-12101.py -u example.com --proxy http://127.0.0.1:8080

* If script shows timeout but is accessible via browser, use the proxy.

Arguments

Required (one of):
  -u, --url URL             Single target URL
  -f, --file FILE           File with target URLs (one per line)

Optional:
  -t, --threads THREADS     Number of threads (default: 10)
  -o, --output OUTPUT       Output CSV file (default: cve-2025-12101_results.csv)
  --timeout TIMEOUT         Request timeout in seconds (default: 10)
  --both-protocols          Test both HTTP and HTTPS
  --proxy PROXY             Proxy URL (e.g., http://127.0.0.1:8080)

Example Output

[████████████████████----------] 68.5% | Total: 137/200 | 
Vulnerable: 3 | Not Vulnerable: 130 | Errors: 4

[!] VULNERABLE: https://netscaler1.example.com | Marker: XSSTEST7f3a9b2c

[+] Results saved to: cve-2025-12101_results.csv

Vulnerability Details

Affected Versions:

• NetScaler ADC and Gateway 14.1 before 14.1-56.73
• NetScaler ADC and Gateway 13.1 before 13.1-60.32
• NetScaler ADC 13.1-FIPS before 13.1-37.250
• NetScaler ADC 12.1-FIPS before 12.1-55.333

Affected Configurations:

• Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy)
• AAA virtual server

Legal Disclaimer

FOR AUTHORIZED SECURITY TESTING ONLY

This tool is provided for educational and authorized security testing purposes only. Only use on systems you own or have explicit written permission to test.

Authorized Use:

• Security professionals with written authorization
• Testing your own systems/infrastructure
• Bug bounty programs (within scope)
• Red team exercises with proper agreements

Prohibited Use:

X Unauthorized scanning of third-party systems
X Malicious attacks or exploitation
X Any illegal activities

The author assumes no liability for misuse.

References

• CVE Details
• Citrix Security Bulletin
• watchTowr Labs Research

Credits

• watchTowr Labs (Sina Kheirkhah)

License

This project is licensed under the MIT License - see the LICENSE file for details.

---

⭐ If this tool helped you, please consider giving it a star!