rickgeex/cve-2025-5777-citrixbleedCitrixBleed-2 (CVE-2025-5777) – proof-of-concept exploit for NetScaler ADC/Gateway “memory bleed”
CitrixBleed-2 (CVE-2025-5777) – proof-of-concept exploit for NetScaler ADC/Gateway “memory bleed”
CVE-2025-5777 is a critical unauthenticated out-of-bounds read in Citrix NetScaler ADC/Gateway (Gateway or AAA vServer mode). A single crafted request can dump memory containing session tokens, enabling full authentication bypass—earning the nickname “CitrixBleed 2.”
Patched builds were published on 17 June 2025:
No official mitigations exist for unpatched systems.
The information provided on this Github repository is for educational purposes only. All information on this Github is provided in good faith, however I make no representation or warranty of any kind, express or implied, regarding the accuracy, adequacy, validity, reliability, availability, or completeness of any information. This code is released for educational and defensive purposes only. Before testing, confirm that you own the target or have explicit permission. The PoC leaks live memory; run it on test appliances whenever possible.
This script requires the use of Python3 and the urllib library If you want to test the vulnerability do so on your (non production) systems only
python CVE-2025-5777.py <target.host>
The script ns_log_scanner.py can be used to detect any characters outside of the HEX-range 0x20 until 0x7F (ASCII) or 0x09, 0x0A and 0x0D (horizontal-tab, LF and CR) - which could be binary:
python ns_log_scanner.py /var/log/ns.log # (sample path)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
msg:"doAuthentication bare-login exploit";
flow:established,to_server;
http_method; content:"POST"; nocase;
http_uri; pcre:"/\/p\/u\/doAuthentication\.do(?:[\/\?]|$)/Ui";
http_header; pcre:"/Content-Length\s*:\s*[1-9]\d{0,2}/Hi";
# ‼ Bare “login” – next char must NOT be '='
http_client_body; pcre:"/\blogin(?!\s*=)/i";
classtype:web-application-activity;
sid:1001003; rev:1; metadata:service http;
)
config ips custom-signature
edit "DoAuthentication_BareLogin"
set severity medium
set default-application signature
set service "HTTP"
set direction clienttoServer
set pattern "GETPOST \/p\/u\/doAuthentication\.do[\/\?]?.*Content-Length:\s*[1-9][0-9]{0,2}.*\blogin(?!\s*=)"
next
end
Author : Mischa Rick van Geelen (@rickgeex)
Company : Anovum B.V.
Contact : [email protected]