CVE-2023-4966
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Description
CVE-2023-4966, widely known as "Citrix Bleed," is a critical information disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway that allows unauthenticated remote attackers to extract sensitive data, including session tokens, from vulnerable devices. The flaw is caused by a buffer-related weakness that leaks memory contents when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. This vulnerability in Citrix NetScaler carries a CVSS score of 9.4 and has been widely exploited by ransomware groups. CISA has added CVE-2023-4966 to the Known Exploited Vulnerabilities catalog, and the EPSS score of 94.3% indicates near-certain exploitation activity across internet-facing NetScaler deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler application delivery controller | >= 12.1, < 12.1-55.300; >= 13.0, < 13.0-92.19; >= 13.1, < 13.1-37.164; >= 13.1, < 13.1-49.15; >= 14.1, < 14.1-8.50 |
| citrix | netscaler gateway | >= 13.0, < 13.0-92.19; >= 13.1, < 13.1-49.15; >= 14.1, < 14.1-8.50 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html(Third Party Advisory, VDB Entry)
- https://support.citrix.com/article/CTX579459(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
The Citrix NetScaler ADC and Gateway contain a buffer over-read weakness that allows data stored in memory beyond the intended buffer boundaries to be disclosed to remote attackers. In the context of CVE-2023-4966, this memory buffer vulnerability enables the extraction of sensitive session tokens and other authentication data from the appliance's memory, which attackers can then use to hijack authenticated sessions.
Learn more: CWE-119 — Buffer Errors
Impact Analysis
CVE-2023-4966 carries a CRITICAL severity rating with a CVSS v3.1 score of 9.4, representing one of the most impactful vulnerabilities affecting network infrastructure in recent years. The vulnerability is remotely exploitable without physical access, requires low attack complexity with no special conditions needed, and critically requires no authentication and no user interaction to exploit. Confidentiality (High): attackers can extract session tokens and other sensitive data from device memory, enabling session hijacking and unauthorized access to internal resources protected by the NetScaler Gateway. Integrity (High): with stolen session tokens, attackers can impersonate legitimate users, bypass multi-factor authentication, and access or modify protected resources as if they were authorized users. Availability (Low): while the vulnerability primarily enables information disclosure, the resulting session hijacking can lead to further compromise with availability implications. The EPSS score of 94.3% (99.9th percentile) confirms near-certain exploitation, and CISA has flagged this vulnerability as actively used in ransomware campaigns, making it an immediate priority for any organization running NetScaler ADC or Gateway.
Exploit Maturity
Public proof-of-concept code is available for CVE-2023-4966 via Packet Storm Security, which demonstrates the session token leakage technique known as "Citrix Bleed." CISA has confirmed active exploitation in the wild and has specifically noted that this vulnerability is used in ransomware campaigns, significantly elevating the threat level. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation activity, placing CVE-2023-4966 among the most actively exploited vulnerabilities tracked by CISA. The combination of unauthenticated remote exploitation, publicly available exploit code, ransomware usage, and the critical role of NetScaler appliances in enterprise network architecture makes this one of the highest-priority vulnerabilities requiring immediate remediation.
Remediation
- Apply vendor mitigations immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Refer to Citrix advisory CTX579459 for specific patched versions of NetScaler ADC and NetScaler Gateway. Given the ransomware association, treat this as the highest-priority patch.
- Invalidate all active and persistent sessions after applying the patch, as session tokens stolen prior to patching remain valid. Terminate all active sessions using the CLI commands provided by Citrix and force all users to re-authenticate. Simply patching the appliance is insufficient if existing session tokens have been compromised.
- Restrict network access to the NetScaler management interface and evaluate whether the Gateway or AAA virtual server configurations that expose the vulnerability are necessary. Implement network segmentation and firewall rules to limit access to the management plane from trusted networks only.
- Conduct thorough forensic investigation on all NetScaler appliances that were exposed to the internet before patching. Check for indicators of compromise including unauthorized session activity, lateral movement from NetScaler-connected networks, newly created accounts, and signs of ransomware staging or deployment.
- Implement enhanced monitoring and detection by deploying intrusion detection rules for Citrix Bleed exploitation attempts, monitoring for anomalous VPN session activity or token reuse from unusual IP addresses, and enabling verbose logging on NetScaler appliances to capture exploitation evidence. Rotate all credentials that may have been accessible through hijacked sessions.
Technical Details
CVE-2023-4966 is a buffer over-read vulnerability in Citrix NetScaler ADC and NetScaler Gateway, classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability occurs when the appliance is configured in specific modes (Gateway with VPN virtual server, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server), where a boundary check failure in memory handling allows remote attackers to read data beyond the intended buffer. As reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U), the attack is trivially exploitable over the network with no authentication, no user interaction, and low complexity. The leaked memory contents include sensitive session tokens that can be replayed by attackers to hijack authenticated sessions, effectively bypassing any authentication mechanisms including multi-factor authentication configured on the Gateway. The high confidentiality and integrity impact (C:H/I:H) with low availability impact (A:L) reflects the nature of the attack: it is primarily an information disclosure that enables session hijacking rather than a direct denial-of-service condition, though the resulting unauthorized access can lead to full network compromise.
Frequently Asked Questions
Is CVE-2023-4966 being actively exploited?
Yes, CVE-2023-4966 ("Citrix Bleed") is under widespread active exploitation. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 8, 2023, and has confirmed its active use in ransomware campaigns. The EPSS score of 94.3% places it at the 99.9th percentile, indicating near-certain exploitation.
What products are affected by CVE-2023-4966?
CVE-2023-4966 affects Citrix NetScaler ADC and Citrix NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Appliances that are not configured in these modes are not vulnerable. Refer to Citrix advisory CTX579459 for the specific affected versions.
How do I fix CVE-2023-4966?
Apply the patched firmware versions provided by Citrix in advisory CTX579459. Critically, after patching you must also invalidate all active and persistent sessions, as stolen session tokens remain valid even after the patch is applied. Force all users to re-authenticate and rotate credentials for any accounts that may have been compromised through session hijacking.
How severe is CVE-2023-4966?
CVE-2023-4966 is rated CRITICAL with a CVSS v3.1 score of 9.4 out of 10. It requires no authentication and no user interaction to exploit, allowing remote attackers to steal session tokens from vulnerable NetScaler appliances. The combination of its critical severity, EPSS score at the 99.9th percentile, and confirmed use in ransomware campaigns makes it one of the most dangerous vulnerabilities currently tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.