##
CitrixBleed-2 (CVE-2025-5777) – proof-of-concept exploit for NetScaler ADC/Gateway “memory bleed”
CVE-2025-5777 is a critical unauthenticated out-of-bounds read in Citrix NetScaler ADC/Gateway (Gateway or AAA vServer mode). A single crafted request can dump memory containing session tokens, enabling full authentication bypass—earning the nickname “CitrixBleed 2.”
Patched builds were published on 17 June 2025:
* NetScaler ADC and NetScaler Gateway 14.1-43.56 and later releases
* NetScaler ADC and NetScaler Gateway 13.1-58.32 and later releases of 13.1
* NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.235 and later releases of 13.1-FIPS and 13.1-NDcPP
* NetScaler ADC 12.1-FIPS 12.1-55.328 and later releases of 12.1-FIPS
No official mitigations exist for unpatched systems.
The information provided on this Github repository is for educational purposes only. All information on this Github is provided in good faith, however I make no representation or warranty of any kind, express or implied, regarding the accuracy, adequacy, validity, reliability, availability, or completeness of any information. This code is released for educational and defensive purposes only. Before testing, confirm that you own the target or have explicit permission. The PoC leaks live memory; run it on test appliances whenever possible.
This script requires the use of Python3 and the urllib library If you want to test the vulnerability do so on your (non production) systems only
The script `ns_log_scanner.py` can be used to detect any characters **outside** of the HEX-range `0x20` until `0x7F` (ASCII) or `0x09`, `0x0A` and `0x0D` (horizontal-tab, LF and CR) - which could be binary:
python ns_log_scanner.py /var/log/ns.log # (sample path)
# Detection of CVE-2025-5777 using IPS/IDS
## Snort example rule for detection (psuedo-code)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
msg:"doAuthentication bare-login exploit";
http_uri; pcre:"/\/p\/u\/doAuthentication\.do(?:[\/\?]|$)/Ui";
http_header; pcre:"/Content-Length\s*:\s*[1-9]\d{0,2}/Hi";
# ‼ Bare “login” – char must NOT be '='
http_client_body; pcre:"/\blogin(?!\s*=)/i";
sid:1001003; rev:1; metadata:service http;
## Fortigate IPS detection rule (pseudo-code)
set pattern "GETPOST \/p\/u\/doAuthentication\.do[\/\?]?.*Content-Length:\s*[1-9][0-9]{0,2}.*\blogin(?!\s*=)"
#### Other resources (updates, detections)
*
*
Author : Mischa Rick van Geelen (@rickgeex)
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
