CitrixBleed 2 Memory Disclosure via CVE-2025-5777

CVE-2025-5777, also known as CitrixBleed 2, is a memory disclosure vulnerability affecting Citrix NetScaler ADC and Gateway appliances. This vulnerability allows an unauthenticated attacker to potentially leak sensitive information, including session tokens and authentication credentials, from the device's memory. The attack involves sending specially crafted POST requests with incomplete form data to the /p/u/doAuthentication.do endpoint. Successful exploitation can lead to unauthorized access to internal resources and systems, posing a significant risk to organizations using affected Citrix products. The vulnerability was publicly disclosed in March 2026 (fictional date based on the source). Defenders should prioritize detecting and mitigating this vulnerability to prevent potential data breaches and unauthorized access.

Attack Chain

1. The attacker identifies a vulnerable Citrix NetScaler ADC or Gateway appliance exposed to the internet.
2. The attacker crafts a malicious POST request with incomplete form data targeting the /p/u/doAuthentication.do endpoint.
3. The attacker sends the crafted POST request to the vulnerable Citrix appliance.
4. The vulnerable appliance processes the request, leading to a memory leak.
5. The response from the Citrix appliance contains sensitive data from memory, including session tokens and potentially authentication credentials.
6. The attacker captures the leaked data from the response.
7. The attacker analyzes the captured data to extract valid session tokens.
8. The attacker uses the stolen session tokens to bypass authentication and gain unauthorized access to internal resources and systems.

Impact

Successful exploitation of CVE-2025-5777 can result in significant data breaches and unauthorized access to sensitive internal resources. An attacker can steal valid session tokens, bypassing authentication mechanisms, and potentially gain complete control over affected Citrix systems. This could lead to the exposure of customer data, intellectual property, and other confidential information. The impact can range from data theft and service disruption to full system compromise, depending on the scope of the attacker's access.

Recommendation

• Deploy the Sigma rule CitrixBleed2_Post_Request to detect suspicious POST requests to the /p/u/doAuthentication.do endpoint in your web server logs.
• Investigate alerts triggered by the CitrixBleed2_UserAgent Sigma rule, focusing on unusual user agents making requests to the vulnerable endpoint.
• Ensure your Citrix NetScaler ADC and Gateway devices are patched to the latest version to mitigate CVE-2025-5777, as recommended in the Citrix advisory.
• Monitor Suricata logs for traffic matching the suricata_citrixbleed2.log attack data provided in the test section to validate detection coverage.