NetScaler ADC flaws exploited in the wild
IPA warns of actively exploited vulnerabilities in Citrix NetScaler ADC and Gateway allowing unauthenticated info leakage or DoS, urging immediate patching.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-4966 as exploited in the wild.
Japan's IPA issued an advisory on multiple vulnerabilities affecting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway), network appliance products widely used for application delivery and remote access. The flaws could allow an unauthenticated remote attacker to leak sensitive information or cause a denial-of-service condition on affected devices.
IPA notes that exploitation of these vulnerabilities has already been observed in the wild and warns that damage could expand if organizations do not act quickly. The advisory urges administrators to update to the vendor-released fixed versions immediately, noting that version 12.1 of both products has reached end-of-life and will not receive patches, meaning organizations still running that version must migrate to a supported release.
Given the timing and product scope, this advisory aligns with the broader Citrix Bleed vulnerability disclosures (CVE-2023-4966 and related issues) that were under active mass exploitation in October 2023, targeting internet-facing NetScaler appliances to hijack authenticated sessions and steal sensitive data.
Mentioned in this report
Detection guidance
Unauthenticated Request to NetScaler ADC/Gateway Sensitive Endpoint Followed by Anomalously Large Response
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unauthenticated HTTP requests to NetScaler ADC/Gateway login or configuration endpoints that return an unusually large response body, a pattern consistent with exploitation of information-disclosure vulnerabilities used to leak session/memory data from the appliance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated NetScaler Request With Oversized Response
id: f7a14093-7b39-5374-a10d-613b83aaaa21
status: experimental
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- /logon/
- /vpn/
- /nitro/
cs-method: GET
cs-cookie: null
large_response:
sc-bytes|gt: 1000000
condition: selection and large_response
fields:
- src-ip
- c-uri
- sc-bytes
falsepositives:
- Legitimate large static content or firmware/update downloads served from the same
endpoints
- Health-check or monitoring tools polling the gateway login page at high frequency
level: medium
tags:
- attack.t1190
- attack.initial-access
author: Vorant
description: Web/application proxy or WAF logs capturing requests to a NetScaler ADC/Gateway
appliance
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20231023-2.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs