Overview

CVE-2025-5777 (commonly referred to as CitrixBleed 2) is an out-of-bounds read vulnerability (CWE-125 / CWE-457) in Citrix NetScaler ADC and NetScaler Gateway. It results from insufficient input validation when processing specially crafted HTTP requests to authentication endpoints. This allows an unauthenticated remote attacker to leak fragments of server memory, including sensitive data such as session tokens (e.g., NSC_AAAC cookies).

The vulnerability is a follow-on to the original CitrixBleed (CVE-2023-4966). Exploitation enables session hijacking and MFA bypass without requiring further interaction. CVSS v3/v4 score: 9.3 (Critical). It was added to the CISA Known Exploited Vulnerabilities catalog on July 10, 2025.

Affected versions

Vulnerable when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server:

  • NetScaler ADC / Gateway 14.1 before 14.1-43.56
  • 13.1 before 13.1-58.32
  • 13.1-FIPS and NDcPP before 13.1-37.235
  • 12.1-FIPS before 12.1-55.328
  • EOL versions 12.1 and 13.0

Patched builds were released starting June 17, 2025 (with updates in late June/early July).

Technical breakdown (root cause)

The flaw resides in the authentication request handler (notably the /p/u/doAuthentication.do endpoint). When processing HTTP POST requests with a malformed parameter (e.g., login present but without a proper value or equals sign), the backend C code skips proper initialization of a stack buffer.

As a result, the response (often in an XML <InitialValue> tag) reflects ~127 bytes of uninitialized stack memory from the previous operations. Repeated requests yield different memory fragments. This is a classic case of use of uninitialized variable combined with out-of-bounds read due to missing bounds checking and zeroing of buffers.

No authentication or complex interaction is needed — the leak occurs pre-authentication.

Attack chain

  1. Attacker sends crafted HTTP POST to the vulnerable authentication endpoint with malformed parameters.
  2. Server returns leaked memory chunks containing session tokens, credentials, or other in-memory data.
  3. Attacker replays valid session cookies (e.g., NSC_AAAC) to hijack active VPN/Gateway sessions, often bypassing MFA.
  4. Further access to internal networks or lateral movement.

Exploitation was observed in the wild as early as June 23, 2025 (before public PoC on July 4). Targeted scanning and APT activity (including zero-day use) were confirmed by GreyNoise, Amazon MadPot, and others.

Detection guidance

  • Monitor for anomalous POST requests to /p/u/doAuthentication.do (or similar auth endpoints) with malformed parameters (missing values, unusual header/body structures).
  • Look for repeated requests from the same source returning varying response content (memory leak signature).
  • Detect use of extracted NSC_AAAC cookies or unusual session activity on Gateway/VPN portals.
  • Network-level: unexpected XML responses containing binary-looking data in <InitialValue> tags.
  • Endpoint logs on NetScaler for unusual authentication failures or memory-related anomalies.

YARA rules and Snort/Suricata signatures targeting the request patterns are available from research publications.

Indicators of compromise

  • Specific request patterns to /p/u/doAuthentication.do with parameters like login (without value).
  • Source IPs associated with early exploitation (initial waves from China-linked infrastructure).
  • Leaked session cookies starting with NSC_AAAC=.
  • References to CitrixBleed 2 tooling/PoCs post-July 4, 2025.

Consult Citrix security bulletin and CISA alerts for full, updated IoC lists.

Mitigation

  • Immediate patching to the fixed builds listed in the Citrix advisory (no effective workarounds available).
  • Restrict public exposure of NetScaler Gateway/AAA interfaces where possible (e.g., via WAF, geo-blocking, or VPN front-ends).
  • Enable strict logging and monitoring of authentication endpoints.
  • Rotate/revoke potentially compromised sessions and enforce short session lifetimes.
  • Follow Citrix recommendations for disabling unnecessary features (e.g., limit Gateway configurations).

Organizations should treat this as high-priority due to the ease of exploitation and direct impact on remote access infrastructure.