A memory leak in NetScaler let attackers copy logged-in sessions. Why patching alone was not enough and what to do after a VPN gateway flaw.
Publicly disclosed: 10 October 2023
NetScaler ADC and NetScaler Gateway (formerly Citrix ADC) are widely used for remote access. On 10 October 2023 Citrix published a fix for a vulnerability that leaked memory contents, including session tokens of logged-in users. With such a token an attacker could take over a session without a password and without MFA. Ransomware groups exploited it widely.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2023-4966 | Critical, CVSS 9.4 (information disclosure) | NetScaler ADC / Gateway 13.0, 13.1, 14.1 configured as Gateway or AAA server | 14.1-8.50, 13.1-49.15, 13.0-92.19 and later |
Session tokens stolen before the update stayed valid. Organizations that only installed the patch could still be accessed through hijacked sessions. Citrix advised terminating all active and persistent sessions after updating.
MFA protects the login. After login, the session token is the key — protect it too.
Sources: Citrix bulletin CTX579459, CISA advisory AA23-325A, NVD CVE-2023-4966.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
