NetScaler ADC flaws exploited in the wild
IPA warns of actively exploited vulnerabilities in Citrix NetScaler ADC and Gateway allowing unauthenticated info leakage or DoS, urging immediate patching.
Japan's IPA issued an advisory on multiple vulnerabilities affecting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway), network appliance products widely used for application delivery and remote access. The flaws could allow an unauthenticated remote attacker to leak sensitive information or cause a denial-of-service condition on affected devices.
IPA notes that exploitation of these vulnerabilities has already been observed in the wild and warns that damage could expand if organizations do not act quickly. The advisory urges administrators to update to the vendor-released fixed versions immediately, noting that version 12.1 of both products has reached end-of-life and will not receive patches, meaning organizations still running that version must migrate to a supported release.
Given the timing and product scope, this advisory aligns with the broader Citrix Bleed vulnerability disclosures (CVE-2023-4966 and related issues) that were under active mass exploitation in October 2023, targeting internet-facing NetScaler appliances to hijack authenticated sessions and steal sensitive data.
Mentioned in this report
Detection guidance
Multiple Source IPs Using Same NetScaler Gateway Session Cookie (Possible Citrix Bleed Session Hijack)
Detects a single NetScaler/Citrix Gateway session identifier (NSC_AAAC/NSC_TMAA cookie) being used from multiple distinct source IP addresses in a short window, consistent with stolen-session reuse after exploitation of NetScaler information-disclosure flaws (e.g. Citrix Bleed). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Multiple Source IPs Using Same NetScaler Gateway Session Cookie
id: 9a1c120b-7761-5cee-8e60-50b961bd8d41
status: experimental
logsource:
category: proxy
product: other
description: Reverse proxy / WAF / load-balancer logs in front of or on the NetScaler
ADC/Gateway appliance
detection:
selection:
c-uri|contains:
- /vpn/
- /logon/
- /oauth/
cs-cookie|contains:
- NSC_AAAC
- NSC_TMAA
- NSC_TMAS
filter:
src-ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
fields:
- src-ip
- cs-cookie
- c-uri
falsepositives:
- Legitimate NAT/proxy/load-balancer setups where many internal clients share an egress
IP
- Mobile carrier-grade NAT causing session cookie to appear from shifting public IPs
level: medium
tags:
- attack.t1190
- attack.initial_access
author: Vorant
Unauthenticated Request to NetScaler ADC/Gateway Sensitive Endpoint Followed by Anomalously Large Response
Detects unauthenticated HTTP requests to NetScaler ADC/Gateway login or configuration endpoints that return an unusually large response body, a pattern consistent with exploitation of information-disclosure vulnerabilities used to leak session/memory data from the appliance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated NetScaler Request With Oversized Response
id: f7a14093-7b39-5374-a10d-613b83aaaa21
status: experimental
logsource:
category: proxy
product: other
description: Web/application proxy or WAF logs capturing requests to a NetScaler
ADC/Gateway appliance
detection:
selection:
c-uri|contains:
- /logon/
- /vpn/
- /nitro/
cs-method: GET
cs-cookie: null
large_response:
sc-bytes|gt: 1000000
condition: selection and large_response
fields:
- src-ip
- c-uri
- sc-bytes
falsepositives:
- Legitimate large static content or firmware/update downloads served from the same
endpoints
- Health-check or monitoring tools polling the gateway login page at high frequency
level: medium
tags:
- attack.t1190
- attack.initial_access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20231023-2.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free