CitrixBleed: session token leak in NetScaler ADC

CitrixBleed is Heartbleed's lesson, relearned nine years later, on the device organisations put at the very edge of their network to keep attackers out.

#The bug

NetScaler ADC and Gateway, when configured as a gateway or AAA virtual server, mishandle a request to an endpoint that reflects the supplied Host header back in the response.

The response buffer is sized on the assumption that the host value is present and bounded. Send a request with an oversized — or absent — Host header and the length calculation is wrong: snprintf returns the length it would have written, the code uses that value to decide how much to send back, and the response includes memory past the end of the intended string.

What comes back is adjacent process memory, roughly 20–30KB per request, repeatable.

#Why it was worse than a memory leak

What lives in that memory is the point: valid NetScaler session tokens.

A session token is a bearer credential. Present it and you are the user who authenticated — with no further checks. So an attacker with a leaked token can:

• Hijack an authenticated session without a password
• Bypass multi-factor authentication entirely

That second point is what made this a crisis. MFA is asserted at authentication time; the session token is what exists afterwards. Steal the token and you inherit an already-MFA'd session. Every control layered on the login flow — push notifications, hardware keys, conditional access — is downstream of the thing being stolen and therefore irrelevant.

Organisations that had done the hard work of rolling out phishing-resistant MFA discovered that their remote-access appliance would hand out post-authentication sessions to anyone who asked politely enough.

#The patch-is-not-enough problem

The patch stops the leak. It does not invalidate tokens already stolen.

So a NetScaler patched on day two, with stolen tokens from day one, remained fully accessible to the attacker. Persisted sessions survive the fix.

Citrix's guidance was explicit and widely under-executed: after patching, kill all active and persistent sessions:

kill icaconnection -all
kill rdp connection -all
kill pcoipConnection -all
kill aaa session -all
clear lb persistentSessions

This was heavily exploited by ransomware operations — LockBit prominently — and a large share of successful intrusions were against organisations that had patched but not cleared sessions. It is the single most important operational detail of this CVE.

#Detection

• Version. NetScaler ADC/Gateway 14.1 before 14.1-8.50, 13.1 before 13.1-49.15, 13.0 before 13.0-92.19, and the 13.1-FIPS / 12.1-FIPS builds. 12.1 is end-of-life and permanently vulnerable — that is a replacement project, not a patch.
• Configuration dependency: only exploitable when configured as a Gateway (VPN vserver, ICA Proxy, CVPN, RDP Proxy) or AAA vserver. An ADC doing pure load balancing is not affected.
• Web logs for requests to /oauth/idp/.well-known/openid-configuration with an abnormally long or missing Host header — the canonical exploit path.
• Session anomalies are the better signal, because the memory read itself is quiet. Look for one session ID used from multiple source IPs, sessions from unexpected geographies, or sessions active without a corresponding authentication event in the logs. That last one is close to definitive: a session that exists but was never logged in.
• Citrix published IoCs; nsconmsg and the shell logs on the appliance retain useful history that most teams never look at.

#Fixing it

1. Patch to a fixed build.
2. Terminate every session, per above. Not optional.
3. Hunt for post-exploitation — assume the window between disclosure and patching was used. Check for new local accounts, altered configuration, and lateral movement from the appliance inward.
4. Rotate credentials for anything reachable from a hijacked session.

#What generalises

The bug class is the same trusted-length over-read as Heartbleed. snprintf returning the would-be length rather than the written length is a well-known C footgun, and it is still shipping in edge security appliances in 2023.

The bigger lesson is about where these devices sit. VPN concentrators, gateways and firewalls are internet-facing by definition, hold credentials by design, are trusted implicitly by everything behind them, and run vendor firmware you cannot inspect, patch yourself, or usually even monitor properly. They are simultaneously the highest-value and least-observable target in most networks — which is why Ivanti, Fortinet, SonicWall and Citrix have taken turns producing exactly this headline.

And operationally: for any credential-leaking vulnerability, remediation is patch plus revoke. If the bug leaks bearer tokens, the tokens outlive the fix. Heartbleed said rotate your keys; CitrixBleed said kill your sessions. It is the same sentence.