Citrix Bleed was assigned a CVSS rating of 9.4/10, making it a high-severity, crucial info disclosure vulnerability. Very similar to this vulnerability, Citrix Bleed’s exploit was solely potential within the cases the place NetScaler ADC and Gateway units have been configured as a Gateway (VPN digital server, ICA Proxy, CVPN, RDP Proxy) or AAA digital server.
This bug’s lack of ability to reveal information with very excessive sensitivity separates it from CVE-2023-4966. “This bug is almost an identical to the Citrix Bleed vulnerability (CVE-2023-4966), besides it’s much less prone to return extremely delicate info to an attacker,” the weblog added.
Citrix silently patched the flaw
Whereas the vulnerability has not been assigned a CVE ID, most likely as a result of Citrix has made no public disclosure in regards to the vulnerability till now, it was noticed to be mounted in NetScaler model 13.1-51.15.
There may be hypothesis that the corporate has silently addressed the difficulty with out making any disclosures. Bishop Fox urged customers to replace to model 13.1-51.15 or later as an answer to this vulnerability.
“The vulnerability permits an attacker to get well doubtlessly delicate information from reminiscence,” Bishop Fox added. “Though usually nothing of worth is returned, we’ve got noticed cases the place POST request our bodies are leaked. These POST requests might include credentials or cookies.” It’s unclear whether or not Citrix had disclosed this vulnerability privately to its prospects or had even acknowledged the difficulty raised by Bishop Fox as a vulnerability.
