Citrix Bleed (CVE-2023-4966)
CVE-2023-4966CWE-119OWASP A07:2021CVSS 9.4Updated August 29, 20261 min read
Citrix Bleed is a vulnerability in NetScaler ADC and NetScaler Gateway that let an unauthenticated attacker read fragments of working memory. That memory held valid session tokens. With one, an attacker took over an existing session, multi-factor authentication already passed. Patching alone was not enough: existing sessions had to be terminated explicitly.
- Affected
- NetScaler ADC and NetScaler Gateway 10.5, 12.1, 13.0, 13.1 and 14.1 before the October 2023 patches
- Patched in
- 14.1-8.50, 13.1-49.15, 13.0-92.19 and the matching FIPS releases
- Actively exploited
- yes
Citrix Bleed showed how little an attacker needs when they get hold of the right piece of memory. The vulnerability leaked no passwords, only session tokens, and in practice those are just as useful.
What is Citrix Bleed
NetScaler ADC and Gateway usually sit at the very front of the network, handling VPN and application access for staff. A specially constructed request made the appliance return more than the answer: it returned part of its own working memory as well. That memory held valid session tokens of employees logged in at that moment.
Why a session token beats a password
A password still has to pass the second factor. A session token is the proof that the check has already been passed. The attacker pasted it into their own browser and was inside as the employee, with no password, no code and no alert. That makes this one of the clearest real-world illustrations of broken authentication.
The mistake many organisations made
The advisory appeared on 10 October 2023. Many organisations patched within days and considered the matter closed. Tokens stolen before that, however, remained perfectly valid. Ransomware affiliates used them over the following weeks to get in at organisations that had patched properly.
What to do now
- Check that your NetScaler runs a build released after October 2023.
- Explicitly terminate all active and persistent sessions after every patch. This is the step most often skipped.
- Bind sessions to an IP address or device where you can, so a stolen token does not work elsewhere.
- Treat edge equipment as the crown jewel it is. Anything internet-facing that grants access deserves a shorter patch window than the rest.
Sources
Frequently asked questions
Why did multi-factor authentication not help?
MFA protects the moment of logging in. A stolen session token belongs to a session that is already logged in, so the attacker never had to pass that check.
Is patching enough?
No. Tokens captured before the patch keep working until the session ends. Citrix explicitly instructs you to terminate all active and persistent sessions after patching.
How would I know if this happened to us?
Look through the logs for sessions that continue from a different IP address or device than the one they started on, and for sign-ins that skip the MFA step.
Related articles
- CVEsCWE-89A03:2021MOVEit Transfer (CVE-2023-34362)CVE-2023-34362 explained: how a SQL injection in MOVEit Transfer gave the Cl0p extortion group access to the data of thousands of organisations.
- GlossaryRansomwareRansomware explained: how this malware encrypts files and systems, how attacks get in, and how to protect your organisation from digital extortion.
- VulnerabilitiesCWE-287A07:2021Broken authenticationBroken authentication explained: how attackers take over accounts through brute force, leaked passwords and predictable session tokens, and how to stop them.
- VulnerabilitiesCWE-639A01:2021Insecure direct object reference (IDOR)IDOR explained: how attackers tamper with IDs in URLs or APIs to read or change other users' data, and how to detect and prevent this vulnerability.