PT-2023-5875 · Citrix+1 · Citrix Netscaler Adc+2

Published 2023-10-10 · Updated 2026-03-16 · CVE-2023-4966

Positive Technologies · (AI Summary)

CVSS v2.0

9.7

9.7

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Citrix NetScaler ADC and NetScaler Gateway versions prior to the fix released on October 10, 2023

Description Citrix NetScaler ADC and NetScaler Gateway are affected by a critical information disclosure vulnerability (CVE-2023-4966). This vulnerability is a buffer overflow that allows unauthenticated attackers to leak sensitive information, including session tokens, from systems configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. Exploitation of this vulnerability has been observed since late August 2023, and multiple threat actors, including ransomware groups like LockBit, have actively exploited it. The vulnerability allows attackers to hijack existing authenticated sessions, potentially bypassing multi-factor authentication. The vulnerability is actively being exploited and a proof-of-concept exploit is publicly available. Numerous organizations have been impacted, including government, legal, and technology sectors. The estimated number of potentially affected devices is in the thousands.

Recommendations Apply the security updates released by Citrix on or after October 10, 2023. Invalidate all active and persistent sessions after applying the patch. Restrict access to vulnerable modules or features if possible. Monitor network traffic for suspicious activity related to the vulnerability.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2023-06568

CVE-2023-4966

Affected Products

Citrix Netscaler Adc

Citrix Netscaler Gateway

Comcast Xfinity

References · 422

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/citrix_bleed_cve_2023_4966.rb · Exploit
• 🔥 https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-4966 · Exploit
• 🔥 https://github.com/dinosn/citrix_cve-2023-4966 · Exploit
• 🔥 https://github.com/sanjai-AK47/CVE-2023-4966 · Exploit
• 🔥 https://github.com/RevoltSecurities/CVE-2023-4966 · Exploit
• 🔥 https://github.com/mlynchcogent/CVE-2023-4966-POC · Exploit
• 🔥 https://github.com/certat/citrix-logchecker · Exploit
• https://support.citrix.com/article/CTX579459 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4966 · Vendor Advisory
• https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4966 · Security Note
• https://netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway · Security Note
• https://bdu.fstec.ru/vul/2023-06568 · Security Note
• https://twitter.com/rjfaulknerjr/status/1716497714530103421 · Twitter Post