CVE-2023-4966

Overview

CVE-2023-4966, nicknamed "CitrixBleed," is a sensitive information disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway. A buffer over-read in the HTTP/S endpoint processing leaks contents of NetScaler memory — including active session tokens for authenticated VPN and application sessions. An unauthenticated attacker who obtains a valid session token can hijack that session, bypassing all authentication including multi-factor authentication, without knowing any user credentials.

Discovered by Mandiant as a zero-day in July 2023, CitrixBleed was exploited for months before patching by nation-state actors, then rapidly adopted by LockBit ransomware and other criminal groups following public disclosure. The exploitation is particularly insidious: patching alone is insufficient — session tokens harvested before patching remain valid until explicitly terminated.

What Is Citrix NetScaler ADC/Gateway?

Citrix NetScaler ADC (Application Delivery Controller, formerly Citrix ADC/NetScaler) and NetScaler Gateway are network appliances providing load balancing, SSL VPN, remote access, and application delivery. NetScaler Gateway is widely deployed as the VPN gateway for corporate remote access, providing employees access to internal applications. Compromise of a Gateway session token provides the same access as a fully authenticated, MFA-verified VPN session — typically full access to the internal corporate network.

Affected Versions

The vulnerability only affects devices configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Devices configured in other modes are not affected.

Technical Details

Root Cause: Buffer Over-Read in HTTP/S Request Processing

The vulnerability is a buffer over-read (a form of CWE-119) in the NetScaler HTTP/S stack when processing requests to Gateway or AAA endpoints. An attacker sends a specially crafted HTTP GET request with a manipulated Content-Length or related header that causes the response handler to read beyond the intended buffer boundary in memory.

The leaked memory region contains data from active NetScaler session structures, including authentication tokens for currently-authenticated VPN and application sessions. These tokens are the same NSC_AAAC and NSC_AAATM cookies issued to legitimate users after MFA-verified login.

Why MFA Does Not Protect Against CitrixBleed

When a user completes a Citrix Gateway login with MFA:

1. MFA is verified; the Gateway issues a session token cookie.
2. The session token is stored in NetScaler memory as part of the active session state.
3. CitrixBleed leaks this in-memory token.
4. The attacker presents the stolen token directly — MFA has already been satisfied for this session.

The attacker never needs to know the user's password or MFA code. The stolen token represents a fully authenticated session.

Critical: Patching Does Not Invalidate Stolen Sessions

Sessions established before patching remain valid after the patch is applied. An attacker who harvested tokens during the zero-day exploitation window retains persistent access until those sessions are explicitly terminated. This is why Citrix's remediation guidance specifically requires killing all active and persistent sessions in addition to patching.

Attack Characteristics

Discovery

Mandiant discovered CVE-2023-4966 while responding to customer incidents and reported it to Citrix in July 2023. Mandiant confirmed exploitation in the wild beginning in late August 2023 — weeks before the patch was available. The exploitation during this window was attributed to a sophisticated threat actor consistent with nation-state behavior. After Citrix patched and Assetnote published the "CitrixBleed" name and technical details (including a PoC) on October 17, 2023, exploitation expanded rapidly to criminal groups.

Exploitation Context

CitrixBleed became one of the most impactful vulnerabilities of 2023:

• LockBit ransomware was the primary criminal exploiter; in November 2023 LockBit used CitrixBleed to breach Boeing, DP World Australia (disrupting port operations nationally), Allen & Overy (global law firm), and ICBC Financial Services New York (disrupting US Treasury bond trading)
• Nation-state exploitation: Mandiant confirmed pre-patch exploitation by a sophisticated threat actor; Google TAG and others confirmed multiple Chinese and Russian APT groups using CitrixBleed for initial access
• Scale: Approximately 10,000 NetScaler instances were estimated to remain unpatched and exposed at peak exploitation
• MFA irrelevance: CitrixBleed rendered MFA completely ineffective for protecting Gateway sessions, invalidating a primary defense many organizations relied upon
• Healthcare and critical infrastructure: Multiple hospitals and critical infrastructure operators were among the victims

Remediation

Step 1: Patch

Upgrade to the fixed NetScaler version for your branch (see table above). NetScaler 12.1 is end-of-life; upgrade to a supported version.

Step 2: Kill All Sessions (Critical — Do Not Skip)

After patching, explicitly terminate all active and persistent sessions:

kill icaconnection -all
kill rdp connection -all
kill pcoipConnection -all
kill aaa session -all
clear lb persistentSessions

These commands must be run on each NetScaler appliance. Sessions established before patching remain valid and potentially compromised until terminated.

Step 3: Hunt for Compromise

Check for evidence of session token theft and use before patching:

• Review NetScaler access logs for requests to Gateway/AAA endpoints from unusual source IPs, especially prior to the patch date
• Use Mandiant's open-source Citrix IOC Scanner to identify indicators of compromise
• Monitor for internal lateral movement from VPN subnet addresses that coincides with the exploitation window

Step 4: Restrict Access

• Place NetScaler management interfaces (NSIP) behind a jump host or VPN — management access should never be internet-exposed
• Review which internal resources are accessible via Gateway and apply least-privilege network segmentation