CVE-2025-5777 Citrix NetScaler Memory Leak: Detecting Session Token Theft

In June 2025, Citrix disclosed a memory disclosure vulnerability in NetScaler ADC and NetScaler Gateway that leaks uninitialized memory containing session tokens, tracked as CVE-2025-5777 and quickly dubbed "CitrixBleed 2" by the security community. Like its predecessor, the flaw allows an unauthenticated attacker to recover valid session cookies and hijack authenticated sessions, bypassing MFA. While Citrix has released patches, many organizations remain exposed or lack detection coverage. This article provides a practical detection engineering guide for SOC teams: how the leak manifests in NetScaler logs, what to look for in authentication and session events, and how to build high-fidelity alerts to catch token theft in progress.

Background: What Is CVE-2025-5777?

CVE-2025-5777 is a memory disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway (formerly Citrix ADC and Citrix Gateway) that affects the handling of certain authentication requests. Under specific conditions, an unauthenticated attacker can cause the appliance to return uninitialized memory in an HTTP response, potentially exposing sensitive data such as session tokens, authentication cookies, and other secrets. The vulnerability is reminiscent of CitrixBleed (CVE-2023-4966), which was widely exploited by ransomware affiliates and APT groups.

Citrix assigned a CVSS v4.0 score of 9.3 (Critical) to CVE-2025-5777. The vulnerability was disclosed in Citrix security bulletin CTX693420 on June 17, 2025, with patches released the same day. The Citrix advisory states that the issue affects NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. The leak occurs when a specific request is sent to the appliance, causing it to return memory that may contain valid session tokens.

“Successful exploitation could allow an attacker to obtain session tokens and hijack authenticated sessions, bypassing multi-factor authentication.” — Citrix Security Bulletin CTX693420

Since disclosure, multiple threat intelligence vendors have reported scanning activity and exploitation attempts in the wild, though mass exploitation has not yet reached the scale of CitrixBleed. The vulnerability is tracked by CISA and has been added to the Known Exploited Vulnerabilities (KEV) catalog.

Affected Versions and Exposure

According to Citrix, the following versions are affected:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-43.56
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-58.32
• NetScaler ADC 13.1-FIPS before 13.1-37.235
• NetScaler ADC 12.1-FIPS before 12.1-55.328
• NetScaler ADC 12.1-NDcPP before 12.1-55.328

Organizations should verify their NetScaler firmware version and apply the relevant hotfix or upgrade to the fixed versions listed in the Citrix advisory. Note that NetScaler ADC and NetScaler Gateway are widely deployed at the network edge, making them attractive targets for attackers seeking initial access.

Citrix has also published a detection guidance document and recommends that customers check for indicators of compromise (IOCs) and invalidate all active sessions after patching. The vendor advisory includes a list of IOCs and a script to check for signs of exploitation.

Attacker TTPs: From Leak to Session Hijack

Exploitation of CVE-2025-5777 follows a predictable pattern that defenders can map to MITRE ATT&CK:

1. Reconnaissance (T1595): Attackers scan for exposed NetScaler Gateway or AAA virtual servers, often using Shodan or similar services. They may fingerprint the appliance by examining HTTP response headers and behavior.
2. Exploitation (T1190): The attacker sends a crafted HTTP request to the vulnerable endpoint, causing the appliance to return memory contents. This is typically a POST request to a specific path (e.g., /oauth/idp/logout or similar) with a manipulated Content-Length header or body. The response may contain a session token in the body or headers.
3. Credential Access (T1539): The attacker extracts valid session cookies (e.g., NSC_AAAC, NSC_TASS, NSC_TMAS) from the leaked memory. These cookies can be used to impersonate an authenticated user without needing credentials or MFA.
4. Initial Access (T1078): The attacker uses the stolen session token to access protected resources, such as internal applications or VPN tunnels. This may allow lateral movement or data exfiltration.
5. Persistence (T1098): In some cases, attackers may create new accounts or modify configurations to maintain access, though this requires additional privileges.

Because the session token is valid, the attacker's activity may appear as legitimate user traffic, making detection challenging. However, anomalies in authentication logs and session behavior can reveal the hijack.

Detection: Hunting for Token Theft in Logs

Effective detection of CVE-2025-5777 exploitation requires monitoring both the exploitation attempt (memory leak) and the subsequent use of stolen tokens. NetScaler appliances generate logs that can be forwarded to a SIEM. The following detection strategies are recommended.

1. Detect the Memory Leak Attempt

The exploitation request often results in an unusually large HTTP response or a response containing binary data. In NetScaler logs, look for HTTP responses with status code 200 and a Content-Length that is abnormally large or contains non-printable characters. However, NetScaler may not log the response body. Instead, focus on request patterns:

• Requests to authentication endpoints (e.g., /cgi/logout, /oauth/idp/logout) with unusual Content-Length values (e.g., larger than expected).
• Repeated requests from the same source IP to these endpoints with varying payloads, indicative of fuzzing or automated exploitation.
• User-Agent strings that are uncommon or match known scanning tools (e.g., python-requests, curl, Go-http-client).

The following Sigma rule detects potential exploitation attempts by identifying requests to logout endpoints with suspicious Content-Length:

title: Citrix NetScaler CVE-2025-5777 Exploitation Attempt
id: 5a4b3c2d-1e2f-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to NetScaler logout endpoints with anomalous Content-Length, potentially indicating CVE-2025-5777 exploitation.
author: CybernytronX
date: 2025/06/20
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem:
      - '/cgi/logout'
      - '/oauth/idp/logout'
      - '/vpn/logout'
    sc-status: 200
  filter:
    cs-content-length: 0
  condition: selection and not filter
falsepositives:
  - Legitimate logout requests with non-zero body
level: high
tags:
  - attack.t1190
  - cve.2025.5777

Note: This rule assumes that legitimate logout requests typically have zero Content-Length. Tune the filter based on your environment.

2. Detect Session Token Reuse from Anomalous Sources

Once a token is stolen, the attacker will use it from a different IP address or user agent. NetScaler logs include client IP, user agent, and session identifiers. Correlate authentication events with subsequent requests:

• Alert when a session token is used from two different IP addresses within a short time window (e.g., 5 minutes).
• Alert when a session token is used from an IP address geolocated in a different country than the original login.
• Alert when a session token is used with a different User-Agent than the one used during login.

The following Splunk query detects token reuse from multiple IPs:

index=netscaler sourcetype="citrix:netscaler:syslog"
| eval session_id = coalesce(NSC_AAAC, NSC_TASS, NSC_TMAS)
| stats dc(src_ip) as ip_count values(src_ip) as ips by session_id, user
| where ip_count > 1
| table session_id, user, ip_count, ips

This query groups by session ID and user, counting distinct source IPs. A count greater than 1 indicates potential token reuse. Tune the time window and thresholds to reduce false positives from mobile users switching networks.

3. Detect Post-Exploitation Activity

After hijacking a session, attackers may perform reconnaissance, lateral movement, or data exfiltration. Monitor for:

• Access to sensitive applications or resources that the user does not normally access.
• Unusual data transfers (large outbound transfers).
• Creation of new administrative accounts or changes to NetScaler configuration.

These behaviors can be detected using UEBA or by correlating NetScaler logs with application logs and network flow data.

Mitigation: Patching and Hardening

The primary mitigation is to apply the patches released by Citrix. Fixed versions are listed in the Citrix advisory. After patching, Citrix recommends invalidating all active sessions to remove any stolen tokens. This can be done via the NetScaler CLI:

flush cache contentgroup 
# or
kill aaa session -all

Additionally, consider the following hardening measures:

• Enable multi-factor authentication (MFA) for all VPN and gateway access. While CVE-2025-5777 bypasses MFA via token theft, MFA still protects against credential-based attacks.
• Restrict access to NetScaler management interfaces to trusted IPs.
• Monitor for unusual authentication patterns and enable logging to a SIEM.
• Apply network segmentation to limit lateral movement from compromised sessions.

Citrix has also published a tool to check for signs of exploitation. Running this tool is recommended as part of incident response.

Why This Matters for Defenders

CVE-2025-5777 is a stark reminder that edge devices remain a prime target for attackers. The vulnerability allows bypassing MFA, which is often considered a silver bullet. Defenders must assume that session tokens can be stolen and implement detection for token misuse. Logging and monitoring of authentication events are critical, but many organizations lack the visibility into NetScaler logs needed to detect such attacks. By implementing the detection rules and mitigation strategies outlined here, security teams can improve their resilience against this and similar threats. Furthermore, the incident highlights the importance of rapid patching and session invalidation after a vulnerability is disclosed. As attackers continue to exploit edge vulnerabilities, proactive defense is essential.

Sources

• Citrix Security Bulletin CTX693420 — Official advisory for CVE-2025-5777, including affected versions, fixed versions, and IOCs.
• CISA Known Exploited Vulnerabilities Catalog — Lists CVE-2025-5777 as actively exploited, with remediation due dates for federal agencies.
• NVD Entry for CVE-2025-5777 — CVSS score, CWE classification, and reference links.
• MITRE ATT&CK T1190: Exploit Public-Facing Application — Technique used for initial exploitation.
• MITRE ATT&CK T1539: Steal Web Session Cookie — Technique for session token theft.

Frequently Asked Questions

What is CVE-2025-5777?

CVE-2025-5777 is a memory disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can leak session tokens, allowing attackers to hijack authenticated sessions and bypass MFA. It was disclosed in June 2025 and is also known as CitrixBleed 2.

Which versions of NetScaler are affected?

Affected versions include NetScaler ADC and NetScaler Gateway 14.1 before 14.1-43.56, 13.1 before 13.1-58.32, and specific FIPS and NDcPP versions. Refer to Citrix Security Bulletin CTX693420 for the complete list.

How can I detect if my NetScaler is compromised?

Look for unusual requests to logout endpoints with anomalous Content-Length, session tokens used from multiple IP addresses, and unexpected configuration changes. Citrix provides an IOC scanner tool. Implement the Sigma and Splunk rules in this article to detect exploitation attempts and token reuse.

Does MFA prevent exploitation of CVE-2025-5777?

No. The vulnerability allows attackers to steal valid session tokens after MFA has been completed, effectively bypassing MFA. Patching is the only complete mitigation.

What should I do immediately after patching?

Invalidate all active sessions to remove any stolen tokens. Citrix recommends using the NetScaler CLI command kill aaa session -all or flushing the content group cache. Also review logs for signs of exploitation and enable enhanced monitoring.

Is CVE-2025-5777 being actively exploited?

Yes. CISA has added CVE-2025-5777 to its Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Organizations should patch urgently.

Need expert help with this?

If you're unsure whether your NetScaler appliances are exposed, or need help building detection coverage for session token theft, CybernytronX can assist. Our team offers penetration testing, SOC build-out, and incident response services, including deployment of our Ethereon AI threat detection platform. We can help you validate your defenses and respond to active threats. Contact us at cybernytronx.com/contact.html or learn more about Ethereon at cybernytronx.com/ethereon.html.