--- key: "case-study-citrix-bleed" title: "Case study: Citrix Bleed (CVE-2023-4966)" url: "https://softwaresecurity.com/domains/appsec/vulnerability-response/case-study-citrix-bleed/" api: "https://softwaresecurity.com/api/v1/articles/case-study-citrix-bleed.json" domain: "appsec" topic: "Application security" type: "Case study" identifiers: ["CWE-119","CWE-613","A07:2025","V7.4.5","CAPEC-593"] tags: ["Memory safety","Account takeover","Authentication and sessions","Vulnerability management"] stages: ["respond"] roles: ["developer","appsec-engineer"] license: "CC-BY-4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" code_license: "MIT" --- # Case study: Citrix Bleed (CVE-2023-4966) How a NetScaler memory over-read leaked session cookies that bypassed passwords and MFA in 2023, why patching did not end hijacked sessions, and how the pattern returned in 2025. Canonical URL: https://softwaresecurity.com/domains/appsec/vulnerability-response/case-study-citrix-bleed/ ## In short Citrix Bleed, CVE-2023-4966, was a memory over-read in NetScaler ADC and NetScaler Gateway appliances configured as a gateway or AAA server: a crafted request made the appliance return memory that included valid session cookies, so attackers could take over users' sessions with no password or MFA. It was exploited from August 2023, before the fix of 10 October 2023, and LockBit 3.0 affiliates used it. Patching stopped new leaks but not sessions already stolen, so the vendor told customers to kill all active and persistent sessions after updating. Treat session revocation as part of the fix, and keep memory-unsafe parsing off internet-facing authentication paths. - The flaw leaked memory, and the memory held bearer session tokens: one read gave an authenticated session that MFA could not stop. - Patching closed the leak; it did not invalidate cookies already taken. The vendor's guidance added `kill aaa session -all` and related commands. - Exploitation began in late August 2023, weeks before the 10 October fix, according to Mandiant as cited by the vendor; CISA added it to KEV on 18 October 2023. - Only appliances configured as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server were affected; plain load balancers were not. - CVE-2025-5777 in June 2025 was another memory over-read on the same configurations, again with advice to kill sessions after upgrading; CISA lists it as exploited, with known ransomware use. - For builders: make 'revoke every session' a tested capability, bind and shorten sessions, and fuzz and bounds-check request parsing in C. ## Incident at a glance - Date: 2023-08 to 2023-11-21 - Category: Vulnerability exploitation - Organizations: Cloud Software Group (Citrix NetScaler); LockBit 3.0 affiliates; Boeing Distribution Inc. - CVE: [CVE-2023-4966](https://nvd.nist.gov/vuln/detail/cve-2023-4966) - Impact: A memory over-read in NetScaler Gateway and AAA configurations leaked valid session cookies, letting attackers take over users' sessions without passwords or MFA. It was exploited before the fix, including by ransomware affiliates. - How it was found: Found by the vendor's internal team; Mandiant's incident investigations after disclosure showed exploitation had begun in late August 2023. ### Timeline 1. 2023-08: Zero-day exploitation begins, per Mandiant as cited by the vendor. 2. 2023-10-10: Citrix releases fixed builds and bulletin CTX579459. 3. 2023-10-17: The bulletin adds exploitation information; Mandiant reports zero-day use. 4. 2023-10-18: CISA adds CVE-2023-4966 to the KEV catalog. 5. 2023-10-23: The vendor advises killing all active and persistent sessions after updating. 6. 2023-11-21: CISA and partners publish AA23-325A on LockBit 3.0 affiliates' use of Citrix Bleed. ## Recommended defaults | Setting | Value | Note | Source | | --- | --- | --- | --- | | CVE-2023-4966 | Sensitive information disclosure, CWE-119; CVSS 3.1 9.4 (vendor) | NVD scores it 7.5. Affects NetScaler configured as Gateway or AAA virtual server. | Citrix CTX579459; NetScaler blog | | Fixed builds | 14.1-8.50, 13.1-49.15 and 13.0-92.19 or later | Plus 13.1-FIPS 13.1-37.164 and 12.1-FIPS and NDcPP 12.1-55.300; standard 12.1 was end of life and vulnerable. | Citrix CTX579459 | | After updating | Kill all active and persistent sessions | `kill icaconnection -all`, `kill rdp connection -all`, `kill pcoipConnection -all`, `kill aaa session -all`, `clear lb persistentSessions`. | NetScaler blog, 23 October 2023 | | CISA KEV | Added 18 October 2023; known ransomware use | CISA AA23-325A describes LockBit 3.0 affiliates exploiting it. | CISA KEV; CISA AA23-325A | | Recurrence | CVE-2025-5777 (June 2025), memory over-read; fixed in 14.1-43.56 and 13.1-58.32 | Versions 12.1 and 13.0 are end of life. CISA added it to KEV on 10 July 2025. | Citrix CTX693420; CISA KEV | ## Verify it 1. Inventory every NetScaler ADC and Gateway, with its build and whether it is configured as a Gateway or AAA virtual server, and compare each build with the latest bulletins, not only CVE-2023-4966. 2. Confirm the runbook for an edge-device fix includes session revocation after every appliance in the HA pair or cluster is upgraded. 3. For services you build, run the 'revoke all sessions' path in a test environment and confirm a previously valid cookie is rejected everywhere it is accepted. 4. Check that session tokens are bound to more than possession where you can (device or client signals) and that idle and absolute lifetimes are short for remote access. 5. Fuzz the request parsing of any C or C++ component that sits in front of authentication, with sanitizers on. ## What you will learn - Explain how a memory over-read turned into an MFA bypass through leaked session cookies. - Plan a response to a credential-leaking flaw that patches, revokes sessions and hunts, in that order. - Design session revocation and lifetimes that limit what a leaked cookie is worth. - Separate the vendor's and CISA's findings from third-party analysis. Audience: Engineers who build gateways, VPNs, authentication front ends and session handling, and the operations and PSIRT teams who respond to edge-device advisories Before you start: - Know what a session cookie is and why it acts as a bearer credential. - Know what an out-of-bounds read is in C or C++. - For the code: Python 3 for the build check. Time: About 28 minutes: 10 to read and 18 for the exercise ## Leaked memory that contained live session cookies NetScaler ADC and NetScaler Gateway, sold by Citrix and now by Cloud Software Group, are appliances that front remote access: VPNs, Citrix virtual desktops and other internal applications. On 10 October 2023 the vendor released fixes for CVE-2023-4966, a 'sensitive information disclosure' flaw classed as CWE-119 that its internal team had found. It affected appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server; the vendor scored it CVSS 9.4 (NVD's own score is 7.5) and said there was no workaround. The information it disclosed was memory, and the memory held session cookies. CISA's advisory AA23-325A describes attackers 'sending an HTTP GET request with a crafted HTTP Host header, leading to a vulnerable appliance returning system memory information' that contained a valid NetScaler AAA session cookie. With it, they could 'establish an authenticated session within the NetScaler appliance without a username, password, or access to MFA tokens.' The vulnerability came to be called Citrix Bleed; CISA's advisory uses the name. Exploitation had started before the fix. The vendor reports that Mandiant found zero-day exploitation beginning in late August 2023, and CISA dates exploitation activity 'as early as August 2023'. Patching stopped new leaks, but every cookie stolen before the patch kept working, which is why the vendor's follow-up guidance told customers to kill all sessions. ## Timeline | When | Event | Source | | --- | --- | --- | | Late August 2023 | Zero-day exploitation begins, according to Mandiant's investigation. | NetScaler blog, citing Mandiant | | 2023-10-10 | Citrix publishes bulletin CTX579459 and fixed builds for CVE-2023-4966 and CVE-2023-4967; the vendor says it knew of no exploitation at disclosure. | Citrix CTX579459; NetScaler blog | | 2023-10-17 | The bulletin is updated with information on exploitation; Mandiant publishes its findings. | Citrix CTX579459; NetScaler blog | | 2023-10-18 | CISA adds CVE-2023-4966 to the Known Exploited Vulnerabilities catalog. | CISA KEV | | 2023-10-23 | The vendor reports incidents consistent with session hijacking and recommends killing all active and persistent sessions after updating. | NetScaler blog | | 2023-11-21 | CISA, the FBI, MS-ISAC and Australia's ACSC publish AA23-325A on LockBit 3.0 affiliates exploiting Citrix Bleed, with indicators from Boeing. | CISA AA23-325A | | 2025-06-17 | Citrix publishes CTX693420 for CVE-2025-5777, another memory over-read on Gateway and AAA configurations. | Citrix CTX693420 | | 2025-07-10 | CISA adds CVE-2025-5777 to KEV; the catalog now lists known ransomware use. | CISA KEV | ## How a memory over-read became an MFA bypass Citrix has kept technical details to the bulletin, so the public primary record of the mechanism is CISA's description: a crafted Host header in a GET request made the appliance return memory beyond what it should have, and that memory could contain the AAA session cookie of a user who was already signed in. No memory was written and no code was run on the appliance; the attacker simply read a credential. That credential was the whole of the user's authentication. Once a user had passed the password and MFA checks, the cookie alone represented the session, so 'MFA to NetScaler will not operate as intended due to the attacker bypassing authentication by providing a token/session for an already authenticated user', as CISA puts it. From the gateway session, affiliates moved to virtual desktops and the internal network, and CISA lists the remote management tools, scripts and credential dumping that followed. Two design facts combined. Request handling in a memory-unsafe language could return bytes it should not, and the most valuable bytes nearby were bearer tokens that worked from anywhere. The C and C++ memory-safety guide (/domains/appsec/platform-security/memory-safety-c-cpp/) covers the first, and the session guide (/domains/identity-crypto/authentication/session-lifecycle/) the second. ## Why patching did not end the intrusion A patch changes what the appliance does with the next request. It does nothing to sessions an attacker already holds. On 23 October 2023 the vendor reported 'incidents consistent with session hijacking' and recommended that customers, after installing the fixed builds, kill 'all active and persistent sessions' with five commands that terminate ICA, RDP and PCoIP connections, end AAA sessions and clear load-balancing persistence. CISA's advisory goes further for appliances that may already have been used: isolate them until patched, hunt for activity in sessions, and if compromise is found 'assume that threat actors hold full administrative access', reimage hosts and issue new credentials. The lesson for anyone who writes advisories is that the remediation for a credential-leaking flaw has two halves, and the second half has to be in the first advisory. The lesson for anyone who builds authentication is that revoking every session must be a capability that exists, is fast, and has been tested. ASVS 5.0 requirement V7.4.5 asks that administrators can 'terminate active sessions for an individual user or for all users.' ## It happened again in 2025 On 17 June 2025 Citrix published bulletin CTX693420 for CVE-2025-5777, 'Insufficient input validation leading to memory overread', on the same configurations: NetScaler as a Gateway or AAA virtual server. It scored CVSS 4.0 9.3, was fixed in 14.1-43.56 and 13.1-58.32 and later (with FIPS and NDcPP builds), and the bulletin recorded that versions 12.1 and 13.0 were end of life and no longer supported. Its advice again included killing sessions: after all appliances in the HA pair or cluster are upgraded, run `kill icaconnection -all` and `kill pcoipConnection -all`. Third-party researchers nicknamed it CitrixBleed 2. CISA added CVE-2025-5777 to the KEV catalog on 10 July 2025 with a one-day remediation deadline for federal agencies, and the catalog now marks it as used in ransomware campaigns. The bulletin's change history does not record exploitation. The same class of bug, on the same internet-facing code path, leaked the same class of secret twenty months later; root-cause work that ends at the one bug, rather than the class, leaves room for the next one. ## Check appliance builds against the fixes The script takes one version per line, in the `13.1-49.15` form the bulletin uses or the `NS13.1: Build 49.15` form, and reports whether each build is below the CVE-2023-4966 fix for its branch, flags end-of-life branches, and sends FIPS and NDcPP builds to the bulletin's own rows rather than guessing. It ran with Python 3.14 on a sample list. Treat it as one input to an inventory: a build fixed for 2023 can still be vulnerable to later bulletins such as CTX693420, and a version string says nothing about sessions already stolen. ```python """Flag NetScaler ADC and Gateway builds below the CVE-2023-4966 fixes. Input: one version per line, as "13.1-49.13" or "NS13.1: Build 49.13". Fixed builds from Citrix bulletin CTX579459 (standard releases only). A fixed build for CVE-2023-4966 can still be vulnerable to later bulletins. """ import re import sys FIXED = {"14.1": (8, 50), "13.1": (49, 15), "13.0": (92, 19)} END_OF_LIFE = {"12.1", "13.0"} # 13.0 reached end of life after this fix PATTERN = re.compile(r"(?:NS)?(\d+\.\d+)(?::\s*Build\s+|-)(\d+)\.(\d+)") def status(line): if re.search(r"FIPS|NDcPP", line, re.I): return "check the FIPS/NDcPP rows of the bulletin" match = PATTERN.search(line) if not match: return "unrecognized version string" branch, build = match[1], (int(match[2]), int(match[3])) if branch not in FIXED: return f"{branch} has no fix: end of life, replace it" verdict = "VULNERABLE" if build < FIXED[branch] else "fixed for CVE-2023-4966" eol = "; branch is end of life, upgrade to a supported one" if branch in END_OF_LIFE else "" return verdict + eol if __name__ == "__main__": for line in sys.stdin: if line.strip(): print(f"{line.strip()}: {status(line)}") ``` ## Revoke sessions after the update, in the vendor's order These are the vendor's commands from 23 October 2023, run on the NetScaler command line after the fixed build is installed on every appliance. The vendor's note asks that the formatting stay intact when they are copied. For CVE-2025-5777 the bulletin lists the first and third commands, to run after every appliance in the HA pair or cluster is upgraded. Then hunt: users will have to sign in again, and any session that reappears without a fresh sign-in is worth investigating. ```text # 1. Install the fixed build on every appliance first (HA pairs and clusters too). # 2. Then end every session that might rest on a stolen cookie: kill icaconnection -all kill rdp connection -all kill pcoipConnection -all kill aaa session -all clear lb persistentSessions ``` ## Which controls would have stopped or limited it? | Control | Who | SSDF practice or standard | Guide | | --- | --- | --- | --- | | Bounds-checked request parsing, compiler hardening, and memory-safe languages for new parsing code | Vendor | SSDF PW.5.1, PW.6.2 | /domains/appsec/platform-security/memory-safety-c-cpp/ | | Fuzz the request parser with sanitizers, and fix the class after a finding | Vendor | SSDF PW.8.2, RV.3.3 | /domains/appsec/testing/parser-fuzzing/ | | Sessions that can all be revoked quickly; short lifetimes and binding for remote access | Vendor and operator | ASVS V7.4.5; OWASP A07:2025 | /domains/identity-crypto/authentication/session-lifecycle/ | | An advisory whose remediation includes session revocation from the first version | Vendor | SSDF RV.2.2 | /domains/appsec/vulnerability-response/product-incident-response/ | | Patch KEV entries on edge devices within days, then revoke sessions, then hunt | Operator | CISA KEV; SSVC | /frameworks/vulnerability-prioritization/ | | Watch gateway sessions for impossible travel and post-login tooling | Operator | OWASP A09:2025 | /domains/runtime/detection/runtime-detection-response/ | | Retire end-of-life appliance branches before they need an emergency fix | Operator | Supplier lifecycle requirements; SSDF PO.1.3 | /frameworks/supplier-software-assurance/ | ## Lessons that still apply - When a flaw can leak credentials, the fix is patch plus revocation. Put both in the first advisory. - A session cookie that works from anywhere turns any memory disclosure into an account takeover; bind and shorten sessions on remote-access paths. - Make 'end every session now' a tested feature of anything you build that issues sessions. - Internet-facing parsing in C needs fuzzing, bounds checks and a plan to move to memory-safe code; the same bug class returned in 2025. - Edge devices are prime targets. Patch KEV entries on them in days, then hunt in the sessions, not just the logs. ## What the public evidence does not establish Citrix has not published the vulnerable code path, and the vendor says it is 'limiting information to the details contained in its security bulletin'; mechanism details beyond CISA's description come from third-party research. The public record does not give a count of exploited appliances or affected organizations. The start of exploitation in late August 2023 comes from Mandiant's investigations as relayed by the vendor. A build number shows whether an appliance is patched, not whether its sessions were stolen before the patch. For CVE-2025-5777, exploitation is recorded by CISA's KEV catalog, not by the Citrix bulletin, and the nickname CitrixBleed 2 is third-party usage. ## Guided practice It is 25 October 2023. You run four NetScaler appliances and the identity service behind your company's own customer portal. Decide what each fact means and what to do, in order. Treat the facts as true. ### Supplied material ```text N1: Gateway (VPN virtual server), build 13.1-49.13; patched to 13.1-49.15 on 20 October; no sessions killed since. N2: AAA virtual server, build 14.1-8.50 installed on 11 October, before any reported exploitation in your logs. N3: Load balancer only (no Gateway or AAA virtual server), build 13.1-45.61. N4: Gateway, build 12.1-65.25. Portal: issues 30-day session cookies; there is no way to end all sessions except restarting the session store, which logs out every customer and has never been tested. ``` ### 1. Finish N1 N1 is patched. What is still missing? Worked answer: Session revocation: run the vendor's kill commands now, then hunt in sessions created before the kill for activity such as new accounts or remote management tools. Patching on 20 October did not invalidate cookies stolen earlier. ### 2. Judge N2 N2 was patched the day after the fix. Is it done? Worked answer: Probably safe from new leaks, but exploitation started in late August, before the fix existed, so kill sessions and hunt as for N1. Early patching narrows the window; it does not close the one before disclosure. ### 3. Scope N3 Is N3 affected? Worked answer: Not by CVE-2023-4966, which needs a Gateway or AAA virtual server configuration. Record the configuration check and keep it on supported builds. ### 4. Replace N4 What do you do with N4? Worked answer: 12.1 was end of life and vulnerable with no fix. Isolate it, move its users to a supported, fixed appliance, kill sessions and hunt as if it was compromised. ### 5. Fix the portal What does Citrix Bleed teach about your own portal? Worked answer: A leak of its cookies would give 30 days of access with no way to revoke selectively. Add per-user and global revocation that is tested, shorten lifetimes, re-authenticate for sensitive actions, and consider binding sessions to client signals. Deliverable: An ordered action list for N1 to N4 and three changes to the portal's session design, each with how you will test it. Scope: The appliance facts are a simplified scenario. Whether a given appliance was exploited can only be established by investigation; build numbers and timing narrow the question but do not answer it. Articles and teaching material: CC BY 4.0. Original executable code: MIT. Attribution: Software Security. ## Sources - [Citrix CTX579459: NetScaler ADC and NetScaler Gateway security bulletin for CVE-2023-4966 and CVE-2023-4967](https://support.citrix.com/external/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2023-4966-and-cve-2023-4967). Published 10 October 2023, updated through 15 July 2024. - [NetScaler blog: CVE-2023-4966, critical security update now available for NetScaler ADC and NetScaler Gateway](https://www.netscaler.com/blogs/2023-10/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway). 23 October 2023. - [CISA AA23-325A: LockBit 3.0 ransomware affiliates exploit CVE-2023-4966 Citrix Bleed vulnerability](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a). 21 November 2023. - [CISA Known Exploited Vulnerabilities catalog (CVE-2023-4966 and CVE-2025-5777)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Catalog version 2026.10.08. - [Citrix CTX693420: NetScaler ADC and NetScaler Gateway security bulletin for CVE-2025-5349 and CVE-2025-5777](https://support.citrix.com/external/article/CTX693420/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2025-5349-and-cve-2025-5777.html). Published 17 June 2025. - [NVD: CVE-2023-4966](https://nvd.nist.gov/vuln/detail/CVE-2023-4966) - [OWASP ASVS 5.0.0: V7 Session Management](https://github.com/OWASP/ASVS/blob/v5.0.0_release/5.0/en/0x16-V7-Session-Management.md). Version 5.0.0.