Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway

CVE-2025-5777 is an out-of-bounds read in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN vserver, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. An unauthenticated attacker sends a crafted POST to the login endpoint (/p/u/doAuthentication.do) without a login= parameter body, and the appliance echoes back ~127 bytes of uninitialized stack memory in the <InitialValue> XML field. Repeat the request a few thousand times and you harvest session cookies, credentials, and MFA tokens straight out of TLS memory. Affected: NetScaler ADC/Gateway 14.1 before 14.1-43.56, 13.1 before 13.1-58.32, and all 13.1-FIPS/NDcPP before 13.1-37.235-FIPS. 12.1 and 13.0 are EOL and will not be patched — those appliances are permanently broken.

The vendor's HIGH / 7.5 rating is materially wrong and Citrix knows it. The CVSS vector claims *Confidentiality: High, Integrity: None, Availability: None* — but a leaked authenticated session token collapses directly to Integrity:High and Availability:High because the attacker inherits *whatever the hijacked user could do*, including admin. This is the textbook replay of CVE-2023-4966 (CitrixBleed 1) which enabled the LockBit/Boeing/Comcast/ICBC intrusions. CISA added it to KEV on 2025-07-10; watchTowr, Horizon3, and Assetnote published working PoCs; Shadowserver logged mass exploitation from mid-June 2025. Treat vendor severity as marketing, not signal.

Why this verdict

• KEV + active exploitation: listed 2025-07-10, Shadowserver telemetry confirms mass scanning and successful hits from mid-June onward
• Role multiplier: NetScaler Gateway is a canonical high-value-role component — it IS the identity edge. Chain succeeds → attacker inherits any user's authenticated session including admin → fleet floor is CRITICAL
• No friction on the reach step: unauthenticated, single POST, no UI, no rate limit by default; ~60k appliances directly exposed
• Vendor CVSS is under-scored: I:N/A:N ignores that the leaked data IS the session token; realistic vector is C:H/I:H/A:H → 9.8
• Session-token replay defeats MFA: the token was minted post-MFA, so hardware keys, OTP, and push MFA provide zero defense against replay
• Historical precedent: CitrixBleed 1 (CVE-2023-4966) drove LockBit's biggest 2023 campaign — same class, same appliance, same outcome

Why not higher?

9.8 is effectively the ceiling for a remote unauthenticated compromise of a widely-deployed edge appliance; a 10.0 would require guaranteed pre-auth RCE with no preconditions, and this is a memory-disclosure primitive that requires live sessions to be present in the target's stack. Absent that live traffic, an idle appliance yields little.

Why not lower?

Downgrading to HIGH would require either narrow exposure (there are ~60k reachable devices — the opposite of narrow), the absence of a public PoC (there are three), or no in-the-wild use (KEV-listed with active campaigns). None of those conditions hold. The vendor's 7.5 is a scoring artifact, not a real-world risk statement.

1. Patch to 14.1-43.56 / 13.1-58.32 / 13.1-37.235-FIPS immediately — This is the ONLY durable fix. Per noisgate mitigation SLA for CRITICAL + active KEV exploitation: patch within hours, not days. Schedule the maintenance window today.
2. Kill all active sessions post-upgrade — Patching alone does not evict attackers who already stole tokens. On each appliance run kill aaa session -all, kill icaconnection -all, kill pcoipConnection -all, and rotate all admin passwords and any credentials that transited the box. Do this within the same maintenance window.
3. If you cannot patch in <72h, disable the Gateway/AAA vservers — disable vserver <name> on any VPN, ICA Proxy, CVPN, RDP Proxy, or AAA vserver removes the attack surface entirely until the patch is applied. Yes, this breaks remote access; that is the correct trade under CRITICAL SLA.
4. Deploy the Citrix responder policy from CTX693420 — Vendor-published responder policy blocks the malformed doAuthentication.do request pattern. Interim only — treat as a speed bump while you schedule the reboot, not a substitute for the patch.
5. Hunt for indicators back to 2025-06-01 — Look for high-volume doAuthentication.do POSTs without matching saml/login completions, new admin accounts, config exports, and session cookies used from anomalous ASNs. Feed ns.log to your SIEM if you have not already.
6. Rotate LDAP bind, RADIUS shared secrets, and any stored service credentials on the appliance — If an admin session was hijacked, show run exposes these secrets. Rotate them on the assumption of compromise for any appliance internet-exposed in June 2025.

Run this from an auditor workstation with network reach to the appliance's Gateway vserver — not on the NetScaler itself. Invoke as ./check-citrixbleed2.sh https://gateway.example.com. Requires only curl and grep; no credentials. It sends the malformed doAuthentication POST and inspects the <InitialValue> field for leaked memory.

#!/usr/bin/env bash
# noisgate verifier for CVE-2025-5777 (CitrixBleed 2)
# Usage: ./check-citrixbleed2.sh https://gateway.example.com
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 https://<netscaler-gateway>" >&2
  exit 2
fi

UA="noisgate-verifier/1.0"
ENDPOINT="${TARGET%/}/p/u/doAuthentication.do"

# Malformed body: 'login' key without value triggers the OOB read
RESPONSE=$(curl -sk --max-time 15 \
  -H "User-Agent: $UA" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -X POST --data "login" \
  "$ENDPOINT" 2>/dev/null)

RC=$?
if [[ $RC -ne 0 ]] || [[ -z "$RESPONSE" ]]; then
  echo "UNKNOWN: could not reach $ENDPOINT (curl rc=$RC)"
  exit 2
fi

# Fingerprint 1: must look like a NetScaler nFactor response
if ! grep -qiE "(InitialValue|NSC_|<Response|SAMLResponse)" <<< "$RESPONSE"; then
  echo "UNKNOWN: response does not look like a NetScaler Gateway (is a Gateway/AAA vserver bound here?)"
  exit 2
fi

# Fingerprint 2: on VULNERABLE builds InitialValue is populated with junk
# even though we never supplied a login value. Extract it.
INITIAL=$(grep -oP '(?<=<InitialValue>).*?(?=</InitialValue>)' <<< "$RESPONSE" | head -1)

if [[ -n "$INITIAL" ]] && [[ "${#INITIAL}" -gt 0 ]]; then
  # Non-empty InitialValue on an unauth request = memory being echoed
  echo "VULNERABLE: $ENDPOINT returned non-empty <InitialValue> to unauthenticated request"
  echo "Leaked bytes (first 80): ${INITIAL:0:80}"
  exit 1
fi

# On patched builds InitialValue is absent or empty
if grep -qE "<InitialValue></InitialValue>|<InitialValue/>" <<< "$RESPONSE" || ! grep -q "InitialValue" <<< "$RESPONSE"; then
  echo "PATCHED: $ENDPOINT did not echo memory in <InitialValue>"
  exit 0
fi

echo "UNKNOWN: indeterminate response, inspect manually"
exit 2

Sources

1. Citrix advisory CTX693420
2. CISA KEV entry
3. watchTowr Labs writeup + PoC
4. Horizon3 Attack Team analysis
5. Assetnote research
6. NVD entry
7. Shadowserver exploitation telemetry
8. ReliaQuest exploitation report