CVE-2025-5777 — Citrix NetScaler "CitrixBleed 2" Memory Disclosure

Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here.

The sequel to the original CitrixBleed: an out-of-bounds read on NetScaler ADC/Gateway authentication endpoints that hands an unauthenticated attacker fragments of server memory — including session tokens — straight back in the HTTP response.

📄 Full writeup: https://sentinelaidefense.com/posts/cve-2025-5777-citrixbleed-2.html

---

Overview

CVE-2025-5777 (commonly referred to as CitrixBleed 2) is an out-of-bounds read vulnerability (CWE-125 / CWE-457) in Citrix NetScaler ADC and NetScaler Gateway. It results from insufficient input validation when processing specially crafted HTTP requests to authentication endpoints. This allows an unauthenticated remote attacker to leak fragments of server memory, including sensitive data such as session tokens (e.g., NSC_AAAC cookies).

The vulnerability is a follow-on to the original CitrixBleed (CVE-2023-4966). Exploitation enables session hijacking and MFA bypass without requiring further interaction. CVSS v3/v4 score: 9.3 (Critical). It was added to the CISA KEV catalog on July 10, 2025.

Affected Versions

Vulnerable when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server:

• NetScaler ADC / Gateway 14.1 before 14.1-43.56
• 13.1 before 13.1-58.32
• 13.1-FIPS and NDcPP before 13.1-37.235
• 12.1-FIPS before 12.1-55.328
• EOL versions 12.1 and 13.0

Patched builds were released starting June 17, 2025 (with updates in late June / early July).

Technical Breakdown (Root Cause)

The flaw resides in the authentication request handler (notably the /p/u/doAuthentication.do endpoint). When processing HTTP POST requests with a malformed parameter (e.g., login present but without a proper value or equals sign), the backend C code skips proper initialization of a stack buffer.

As a result, the response (often in an XML <InitialValue> tag) reflects ~127 bytes of uninitialized stack memory from previous operations. Repeated requests yield different memory fragments. This is a classic case of use of an uninitialized variable combined with out-of-bounds read due to missing bounds checking and zeroing of buffers.

No authentication or complex interaction is needed — the leak occurs pre-authentication.

Attack Chain

1. Attacker sends a crafted HTTP POST to the vulnerable authentication endpoint with malformed parameters.
2. Server returns leaked memory chunks containing session tokens, credentials, or other in-memory data.
3. Attacker replays valid session cookies (e.g., NSC_AAAC) to hijack active VPN/Gateway sessions, often bypassing MFA.
4. Further access to internal networks or lateral movement.

Exploitation was observed in the wild as early as June 23, 2025 (before the public PoC on July 4). Targeted scanning and APT activity (including zero-day use) were confirmed by GreyNoise, Amazon MadPot, and others.

Detection Guidance

• Monitor for anomalous POST requests to /p/u/doAuthentication.do (or similar auth endpoints) with malformed parameters (missing values, unusual header/body structures).
• Look for repeated requests from the same source returning varying response content (memory leak signature).
• Detect use of extracted NSC_AAAC cookies or unusual session activity on Gateway/VPN portals.
• Network-level: unexpected XML responses containing binary-looking data in <InitialValue> tags.
• Endpoint logs on NetScaler for unusual authentication failures or memory-related anomalies.

YARA rules and Snort/Suricata signatures targeting the request patterns are available from research publications.

Indicators of Compromise

• Specific request patterns to /p/u/doAuthentication.do with parameters like login (without value).
• Source IPs associated with early exploitation (initial waves from China-linked infrastructure).
• Leaked session cookies starting with NSC_AAAC=.
• References to CitrixBleed 2 tooling/PoCs post-July 4, 2025.

Consult the Citrix security bulletin and CISA alerts for full, updated IoC lists.

Mitigation

• Immediate patching to the fixed builds listed in the Citrix advisory (no effective workarounds available).
• Restrict public exposure of NetScaler Gateway/AAA interfaces where possible (e.g., via WAF, geo-blocking, or VPN front-ends).
• Enable strict logging and monitoring of authentication endpoints.
• Rotate/revoke potentially compromised sessions and enforce short session lifetimes.
• Follow Citrix recommendations for disabling unnecessary features (e.g., limit Gateway configurations).

Treat this as high-priority due to the ease of exploitation and direct impact on remote access infrastructure.

References

• Citrix Security Bulletin for CVE-2025-5777
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-5777
• CISA Known Exploited Vulnerabilities Catalog (added 2025-07-10)

Disclaimer

This repository is published for defensive and educational purposes only. It contains analysis, detection logic, and mitigation guidance. No functional exploit code is provided. Use this information only on systems you are authorized to test and defend.

---

_{Maintained by Sentinel AI Defense · Findings shared responsibly under coordinated disclosure.}