CVE-2025-5777 PoC — NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

Description

CVE-2025-5777 (CitrixBleed 2) - Critical memory leak vulnerability affecting Citrix NetScaler ADC and Gateway devices

Readme

# CVE-2025-5777 Citrix NetScaler Memory Leak Exploit

> [!WARNING]
> This script is intended for **educational and research purposes only**. Do not use it against systems without **explicit permission**. Unauthorized access or testing is illegal and unethical. Read the full [DISCLAIMER](DISCLAIMER.md) before using this script.

## Overview

This project demonstrates a memory leak vulnerability ([CVE-2025-5777](https://nvd.nist.gov/vuln/detail/CVE-2025-5777)) found in **Citrix NetScaler** appliances. The vulnerability results from improper handling of uninitialized memory when parsing malformed `POST` data, particularly the `login` parameter. It's widely known as **CitrixBleed 2** because of its strong resemblance to the infamous [CVE-2023-4966](https://nvd.nist.gov/vuln/detail/cve-2023-4966) (original CitrixBleed) which was heavily exploited in 2023

When the `login` field is included **without an equal sign or value**, a portion of uninitialized stack memory is returned inside the `<InitialValue>` tag in the XML response.

![2025-07-08_23-17](https://github.com/user-attachments/assets/8a64f2c7-d156-48b3-ba29-97f0b78bc646)


**Data Leaked:** Each HTTP request can leak approximately 127 bytes of RAM content. By repeating these requests, attackers can collect sensitive data from memory, which may include:
* Session tokens (allowing session hijacking and bypassing MFA).
* Authentication data.
* Portions of previous HTTP requests.
* Plaintext credentials.
* Other sensitive information.

## Script Usage

### Requirements / Dependencies

```bash
pip3 install aiohttp colorama
```

### Run the script

```bash
python3 exploit.py <URL> [options]
```

### Examples

Basic usage:

![2025-07-08_20-00](https://github.com/user-attachments/assets/cbbcd461-067d-4984-b150-0c60adf20e2a)


Verbose with proxy:

![2025-07-08_20-02](https://github.com/user-attachments/assets/dd35ff41-bb18-43ac-8c45-0f67ab6c7580)

Help `-h`:

![2025-07-08_23-09](https://github.com/user-attachments/assets/a7a7ab66-4337-41ad-911e-62c20d9b83e9)


### How it work
This Python script:
- Send repeated malformed POST requests.
- Parse XML responses.
- Extract leaked memory from `<InitialValue>` fields.
- Display it in a hex-dump format like the `xxd` tool.
- Support optional proxying, threading and verbose output for analysis.

## Impact

* **Session Hijacking:** The primary concern is the theft of session tokens, which allows attackers to hijack active user sessions and gain unauthorized access to critical systems, even if multi-factor authentication (MFA) is enabled.
* **Bypassing Authentication:** Stolen session tokens or credentials can be used to completely bypass the authentication process.
* **Data Disclosure:** Sensitive information residing in memory can be exposed.

![Screenshot 2025-07-08 232248](https://github.com/user-attachments/assets/74d0170e-84cb-4578-bc70-6e0770c83905)


## Defense & Mitigation

* [Update](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420) to the latest secure firmware immediately.
* Monitor for abnormal POST request patterns.


## Reference

* [watchTowr Blog Post](https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/) - *Original analysis*

File Snapshot

Remarks