Citrix Bleed (CVE-2023-4966).

A memory disclosure flaw in Citrix NetScaler ADC and Gateway that leaks session tokens, enabling attackers to hijack authenticated sessions without credentials or MFA. It belongs to the Vulnerabilities category of cybersecurity.

A memory disclosure flaw in Citrix NetScaler ADC and Gateway that leaks session tokens, enabling attackers to hijack authenticated sessions without credentials or MFA.

Citrix Bleed, tracked as CVE-2023-4966, is an information-disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway disclosed in October 2023. By sending a crafted HTTP request to the appliance, an unauthenticated attacker can read uninitialized memory and extract valid session tokens, including those issued after MFA. Replaying a stolen token gives the attacker the same access as the legitimate user, bypassing strong authentication. The flaw was mass-exploited by ransomware groups including LockBit, hitting Boeing, the Industrial and Commercial Bank of China and Toyota Financial Services. Fixing requires patching to 13.1-49.15 / 14.1-8.50 or later and invalidating all active sessions.

Defences for Citrix Bleed (CVE-2023-4966) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: CVE-2023-4966, NetScaler session leak.