CVE-2025-5777 — CitrixBleed 2 (Citrix NetScaler Memory Disclosure)

CVSS 9.3 — Critical — Active exploitation in the wild

CitrixBleed 2 is a memory disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Insufficient input validation in the authentication endpoint causes a memory overread (CWE-125), allowing an unauthenticated attacker to leak sensitive memory contents — including session cookies, cryptographic material, and other secrets.

Overview

Technical Details

The vulnerability resides in the authentication endpoint:

POST /p/u/doAuthentication.do

By sending a request with an empty login parameter, the server's input validation is bypassed, causing it to copy uninitialized memory into the response. The leaked data appears inside <InitialValue> XML elements in the HTTP response.

An attacker can chain the memory leak with a session-hijacking attack by extracting NSC_AAAC session cookies from the leaked memory.

What is leaked

• Session cookies (NSC_AAAC, NSC_TEMP, etc.)
• Internal IP addresses
• Stack / heap fragments
• Cryptographic key material (observed in some leaks)
• Other users' session tokens

Affected Versions

Only appliances configured as Gateway (VPN / ICA / CVPN / RDP Proxy) or AAA virtual server are affected. Appliance mode (L2/L3) is not vulnerable.

Reproduction Steps

1. Identify a Citrix NetScaler ADC/Gateway running a vulnerable version.
2. Verify Gateway or AAA virtual server mode is configured.
3. Send a POST request to /p/u/doAuthentication.do with an empty login parameter.
4. Capture the HTTP response and extract <InitialValue> element values.
5. Inspect leaked data for session cookies and other secrets.
6. If an NSC_AAAC cookie is found, use it to impersonate the victim session.

PoC

POST /p/u/doAuthentication.do HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded

login=&passwd=foo

The response will contain <InitialValue> tags with leaked memory contents. On a patched system, <InitialValue> should simply be empty.

Mitigation

1. Upgrade to the patched firmware version listed above.
2. Invalidate all active sessions after patching to ensure any leaked tokens are no longer valid.
3. Where immediate patching is not possible, restrict access to the management interface and authentication endpoints via ACLs or WAF rules.
4. Monitor for signs of exploitation — unexpected requests to /p/u/doAuthentication.do with empty parameters.

References

• Citrix Security Advisory: https://support.citrix.com/article/CTX691608
• CVE Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-5777
• NVD: https://nvd.nist.gov/