CVE-2025-5777 PoC — NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

Description

Memory disclosure vulnerability in Citrix NetScaler ADC and Gateway when configured as a Gateway (VPN virtual server, ICA proxy, CVPN, RDP Proxy).

Readme

# CitrixBleed2 - CVE-2025-5777 PoC Scanner

This repository contains an advanced Proof of Concept (PoC) scanner for **CVE-2025-5777**, dubbed **CitrixBleed2**, a memory disclosure vulnerability affecting Citrix NetScaler ADC and Gateway.

I did some changes to the original poc, this script is based on research originally published by WatchTowr Labs, with enhancements for deeper information extraction and secure memory leak analysis.

> **Disclaimer**: This tool is provided for **educational and authorized testing** purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal.

---

## About the Vulnerability - CVE-2025-5777

**CVE-2025-5777** is a memory disclosure vulnerability in **Citrix NetScaler ADC and Gateway** when configured as a Gateway (VPN virtual server, ICA proxy, CVPN, RDP Proxy).

By sending specially crafted HTTP POST requests to the authentication endpoint, an unauthenticated attacker can trigger memory disclosure — leaking sensitive data from heap memory.

This issue is a follow-up to the original "CitrixBleed" (CVE-2023-4966), and was disclosed in July 2025.

### Technical Summary:

* **Vulnerable Endpoint:** `/p/u/doAuthentication.do`
* **Attack Vector:** Network (unauthenticated)
* **Impact:** Disclosure of memory content
* **CVSS Score:** 7.5 (High)
* **Disclosure Source:** [WatchTowr Labs](https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/)
* **DoublePulsar:** [DoubblePulsar](https://doublepulsar.com/citrixbleed-2-electric-boogaloo-cve-2025-5777-c7f5e349d206/)

The original discovery and in-depth analysis were conducted by the WatchTowr Labs research team. This PoC was inspired by their publication and enhanced for extended detection, evidence logging, and memory analysis by me.
---

## Features

* Exploits the CVE-2025-5777 (CitrixBleed2) memory disclosure vulnerability
* Collects leaked memory content via crafted `POST /p/u/doAuthentication.do` requests
* Extracts sensitive data like:

  * Session cookies
  * Tokens
  * Basic Auth headers
  * Passwords and JWTs
* Displays and logs TLS certificate metadata (subject, issuer, validity)
* Automatically redacts known branding from specific organizations (e.g., removed specific vendor mentions)
* Saves leaks with a timestamped output file to prevent overwrites

---

## Usage

### Single Target

```bash
python3 cve-2025-5777.py -t <target> -r 5 -T 5 -v
```

### List of Targets

```bash
python3 cve-2025-5777.py -l targets.txt -r 3 -T 10
```

### Output File Customization

```bash
python3 cve-2025-5777.py -t <target> -o custom_output.txt
```

If `-o` is not specified, a timestamped file is created automatically (e.g., `citrix_leaks_20250705_154312.txt`).

---

## Detection Technique

The tool sends malformed authentication requests to:

```
POST /p/u/doAuthentication.do HTTP/1.0
```

With a short payload and specific `User-Agent` to trigger the memory leak.

It parses the raw response for high entropy data, certificate metadata, and sensitive content (via regex).

---

## Legal Notice

* This tool must only be used in **authorized** penetration testing or **controlled environments**.
* All users are solely responsible for ensuring legal and ethical use.

---

## Credits

* **Original discovery and writeup**: [WatchTowr Labs](https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/)
* **Enhanced PoC author**: Guilherme Nocera ([@guilhermenocera1](https://instagram.com/guilhermenocera1))
* Based on open-source research and crafted for Brazilian and global security professionals.

---

## Related

* [CVE Details - CVE-2025-5777](https://nvd.nist.gov/vuln/detail/CVE-2025-5777)
* [Citrix security advisories](https://www.citrix.com/support/security-bulletins.html)
* [WatchTowr Labs Article](https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/)

---

## License

This repository is released under the MIT License.

Stay secure. Test responsibly.

File Snapshot

Remarks