Analytics Story: Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777

Date: 2025-01-07 ID: f8a7d2e1-9b3c-4f5e-a8d6-c7b4e9a2f1d8 Author: Michael Haag, Splunk Product: Splunk Enterprise Security

Description

A critical security update, CVE-2025-5777, has been released for NetScaler ADC and NetScaler Gateway. This vulnerability, dubbed "CitrixBleed 2," represents a memory disclosure flaw that can result in unauthorized data disclosure if exploited. Unlike CVE-2023-4966 (the original CitrixBleed), this vulnerability is triggered by sending POST requests with incomplete form data to the /p/u/doAuthentication.do endpoint, causing the device to leak memory contents including session tokens, authentication cookies, and other critical data that can lead to session hijacking and unauthorized access. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-5777 to its Known Exploited and Vulnerabilities Catalog due to active exploitation in the wild since mid-June 2025. No workarounds are available for this vulnerability, and immediate installation of the recommended builds is strongly advised.

Why it matters

On June 17, 2025, Cloud Software Group released emergency security updates to fix CVE-2025-5777, a critical vulnerability affecting NetScaler ADC and NetScaler Gateway. This vulnerability, known as "CitrixBleed 2," is a memory disclosure flaw that allows unauthenticated remote attackers to obtain sensitive information from NetScaler appliances configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers. The primary attack vector involves sending POST requests with incomplete form data (such as "login=" without a value) to the "/p/u/doAuthentication.do" endpoint, causing the device to leak up to 127 bytes of adjacent memory contents including session tokens, SAML StateContext, MFA tokens, and other authentication materials. A secondary attack vector still uses oversized Host headers targeting "/nf/auth/startwebview.do" similar to the original CitrixBleed, but the primary exploitation method represents a new vulnerability in form data processing. Security researchers have observed active exploitation attempts since mid-June 2025, with threat actors using automated tools including HeadlessChrome user agents to scan for vulnerable instances. The leaked session tokens can be directly reused to bypass authentication, including multi-factor authentication (MFA), allowing attackers to gain unauthorized access to protected resources and deploy web shells for persistence. CISA added CVE-2025-5777 to its Known Exploited Vulnerabilities Catalog on June 23, 2025, indicating widespread exploitation attempts. Organizations are strongly advised to immediately apply patches, kill all active sessions, monitor for signs of compromise, and implement additional detection for both the primary POST-based attack vector and the secondary Host header attack vector as no workarounds are available for this critical vulnerability.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt	Exploitation for Client Execution, Command and Scripting Interpreter	TTP
Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure	Exploit Public-Facing Application	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Cisco Secure Firewall Threat Defense Intrusion Event	N/A	`cisco:sfw:estreamer`	`not_applicable`
Suricata	N/A	`suricata`	`suricata`

References

Source: GitHub | Version: 1