{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2023-4966/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*","cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*","cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*","cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.4,"id":"CVE-2023-4966"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-AKSHTHEJO-CVE-2023-4966-EXPLOIT\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["citrix","cve-2023-4966","session-hijacking","data-disclosure"],"_cs_type":"advisory","_cs_vendors":["Citrix"],"content_html":"\u003cp\u003eThe Citrix Bleed vulnerability (CVE-2023-4966) is a critical security flaw affecting Citrix ADC and Gateway appliances. This vulnerability allows an unauthenticated attacker to perform unauthorized data disclosure. Successful exploitation leads to the leakage of session tokens, potentially enabling attackers to hijack legitimate user sessions. The vulnerability was widely discussed in late 2023, with proof-of-concept exploits rapidly emerging. Organizations that have not patched their Citrix ADC and Gateway appliances are vulnerable to session hijacking and subsequent data breaches. The scope of potential attacks is broad, affecting any organization using vulnerable Citrix appliances for remote access or application delivery.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker sends a crafted HTTP request to a vulnerable Citrix ADC or Gateway appliance, specifically targeting the \u003ccode\u003e/oauth/idp/.well-known/openid-configuration\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe vulnerable appliance processes the request without proper sanitization, leading to information leakage.\u003c/li\u003e\n\u003cli\u003eThe appliance responds with an HTTP 200 OK status code, including sensitive data in the response body.\u003c/li\u003e\n\u003cli\u003eThe attacker captures leaked session tokens from the HTTP response.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the stolen session tokens to authenticate to Citrix resources as a legitimate user.\u003c/li\u003e\n\u003cli\u003eThe attacker bypasses multi-factor authentication (MFA) if only session-based.\u003c/li\u003e\n\u003cli\u003eThe attacker gains unauthorized access to internal applications and data.\u003c/li\u003e\n\u003cli\u003eThe attacker exfiltrates sensitive information or performs other malicious actions within the compromised network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2023-4966 can have severe consequences. An attacker can hijack legitimate user sessions, bypassing authentication mechanisms, including MFA in some cases. This grants them unauthorized access to sensitive internal applications, data, and resources. The leaked session tokens can be used to move laterally within the network, potentially compromising additional systems. The impact includes data breaches, financial losses, reputational damage, and legal liabilities.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the latest security patches provided by Citrix for CVE-2023-4966 immediately to your Citrix ADC and Gateway appliances.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eCitrix ADC and Gateway Unauthorized Data Disclosure\u003c/code\u003e to your SIEM to detect exploitation attempts, monitoring web traffic for requests to \u003ccode\u003e/oauth/idp/.well-known/openid-configuration\u003c/code\u003e with a 200 status code.\u003c/li\u003e\n\u003cli\u003eReview web server logs for unusual activity targeting the \u003ccode\u003e/oauth/idp/.well-known/openid-configuration\u003c/code\u003e endpoint, paying close attention to the \u003ccode\u003eurl\u003c/code\u003e and \u003ccode\u003estatus\u003c/code\u003e fields.\u003c/li\u003e\n\u003cli\u003eImplement multi-factor authentication (MFA) mechanisms that are resistant to session hijacking.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T02:49:02Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-citrix-bleed/","summary":"Exploitation of CVE-2023-4966, known as Citrix Bleed, allows unauthorized data disclosure via the /oauth/idp/.well-known/openid-configuration endpoint, leading to session token theft and potential unauthorized access.","title":"Citrix ADC and Gateway Unauthorized Data Disclosure (CVE-2023-4966)","url":"https://feed.craftedsignal.io/briefs/2024-01-citrix-bleed/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2023-4966","version":"https://jsonfeed.org/version/1.1"}