Citrix NetScaler ADC/Gateway Pre-Auth SAML Heap Overflow to Root RCE

#!/usr/bin/env bash
# check_cve_2026_8452.sh — Safe detection for CVE-2026-8452 (NetScaler SAML heap overflow)
# Based on Bishop Fox's response-differential oracle methodology
# Outputs: VULNERABLE / PATCHED / UNAFFECTED / UNKNOWN
# Exit codes: 2=VULNERABLE, 0=PATCHED, 1=UNKNOWN/UNAFFECTED

set -euo pipefail

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <hostname_or_ip>" >&2
  exit 1
fi

BASE_URL="https://${TARGET}"
TIMEOUT=10

# Generate a PrefixList payload of specified byte length
generate_prefixlist() {
  local size=$1
  python3 -c "print(' '.join(['ns' + str(i) for i in range($size // 4)])[:$size])"
}

# SAML envelope with PrefixList injection
build_saml_request() {
  local prefixlist="$1"
  cat <<SAMLEOF
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Version="2.0" ID="_test">
  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:SignedInfo>
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
        <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="${prefixlist}"/>
      </ds:CanonicalizationMethod>
      <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
    </ds:SignedInfo>
    <ds:SignatureValue>dGVzdA==</ds:SignatureValue>
  </ds:Signature>
</samlp:AuthnRequest>
SAMLEOF
}

echo "[*] Testing ${TARGET} for CVE-2026-8452..."

# Step 1: Check if target is a NetScaler
HEADERS=$(curl -sk -o /dev/null -D - --max-time "$TIMEOUT" "${BASE_URL}/" 2>/dev/null || true)
if ! echo "$HEADERS" | grep -qi 'netscaler\|citrix\|ns_vip\|Content-Security-Policy.*netscaler'; then
  echo "UNAFFECTED — Target does not appear to be a NetScaler appliance."
  exit 1
fi
echo "[+] Target identified as NetScaler."

# Step 2: Determine SAML endpoint
SAML_PATH=""
for path in "/saml/login" "/cgi/samlauth"; do
  STATUS=$(curl -sk -o /dev/null -w '%{http_code}' --max-time "$TIMEOUT" "${BASE_URL}${path}" 2>/dev/null || echo "000")
  if [[ "$STATUS" != "000" && "$STATUS" != "404" ]]; then
    SAML_PATH="$path"
    echo "[+] SAML endpoint found: ${path}"
    break
  fi
done

if [[ -z "$SAML_PATH" ]]; then
  echo "UNAFFECTED — No SAML endpoint responding. SAML may not be configured."
  exit 1
fi

# Step 3: Send oversized probe (575 bytes — above the 512-byte patch boundary)
LARGE_PL=$(generate_prefixlist 575)
LARGE_SAML=$(build_saml_request "$LARGE_PL")
LARGE_ENCODED=$(echo "$LARGE_SAML" | base64 -w0 2>/dev/null || echo "$LARGE_SAML" | base64 2>/dev/null)
LARGE_RESP=$(curl -sk --max-time "$TIMEOUT" -X POST \
  -d "SAMLRequest=${LARGE_ENCODED}" \
  "${BASE_URL}${SAML_PATH}" 2>/dev/null || echo "CURL_FAIL")

# Step 4: Send control probe (35 bytes — below boundary, both should respond same)
SMALL_PL=$(generate_prefixlist 35)
SMALL_SAML=$(build_saml_request "$SMALL_PL")
SMALL_ENCODED=$(echo "$SMALL_SAML" | base64 -w0 2>/dev/null || echo "$SMALL_SAML" | base64 2>/dev/null)
SMALL_RESP=$(curl -sk --max-time "$TIMEOUT" -X POST \
  -d "SAMLRequest=${SMALL_ENCODED}" \
  "${BASE_URL}${SAML_PATH}" 2>/dev/null || echo "CURL_FAIL")

# Step 5: Evaluate responses
if echo "$LARGE_RESP" | grep -qi 'Malformed Assertion'; then
  echo "PATCHED — Appliance rejected oversized PrefixList with 'Malformed Assertion' (patch boundary active)."
  exit 0
elif echo "$LARGE_RESP" | grep -qi '500.*43549\|Internal Server Error'; then
  echo "VULNERABLE — Appliance returned internal error on oversized PrefixList (no bounds check). PATCH IMMEDIATELY."
  exit 2
elif [[ "$LARGE_RESP" == "CURL_FAIL" ]]; then
  echo "UNKNOWN — Could not connect to SAML endpoint. Verify network connectivity and retry."
  exit 1
else
  echo "UNKNOWN — Unexpected response. Manual verification required."
  echo "  Large probe response (first 200 chars): ${LARGE_RESP:0:200}"
  exit 1
fi