PLAYBOOKSNETHOSTATTRIBDETECT
← all playbooks
EXPLOIT REFERENCE
Citrix Bleed (CVE-2023-4966)
Unauthenticated buffer over-read in Citrix NetScaler. A crafted HTTP GET leaks system memory including active session cookies. Steal the cookie, replay it, hijack the session. Complete MFA bypass without credentials. LockBit used this to breach critical infrastructure at scale.
CVE-2023-4966 · NetScaler ADC/Gateway · session hijack · MFA bypass · no credentials needed
The MFA bypass that doesn't need your password

Citrix Bleed is not a credential theft vulnerability. It is a session theft vulnerability. The attacker sends a crafted HTTP GET request with a specific Host header to the NetScaler. The appliance leaks system memory in the response, including active, authenticated session cookies. The attacker replays the stolen cookie and inherits the authenticated session. MFA is never challenged because the session already passed MFA. The attacker authenticates as the victim user with full access, and the legitimate user's session continues working simultaneously.

LockBit industrialized this. Citrix Bleed was the primary initial access vector for multiple LockBit campaigns against critical infrastructure in late 2023 and early 2024. The exploit was trivial, the impact was total (bypasses all authentication), and the attack surface was massive (internet-facing NetScaler appliances).
Hunt checklist
  1. 1. Check NetScaler logs for exploitation artifacts Search ns.log for HTTP requests returning anomalously large response sizes on paths like /oauth/idp/.well-known/openid-configuration. Normal responses to these endpoints are small. Responses containing leaked memory are disproportionately large. NetScaler ns.log: HTTP/1.1 200 with large payload length on /oauth/idp/ paths
  2. 2. Hunt for impossible travel on session tokens The stolen session cookie is replayed from the attacker's infrastructure. Search for the same user session ID or OAuth token used concurrently from disparate IP addresses: one from the legitimate user and one from the attacker. Transitions from residential ISPs to commercial VPNs or cloud provider IPs within minutes are the signature. IDP/MFA logs: concurrent session use from disparate IPs · Impossible travel logic
  3. 3. Correlate downstream auth events with missing MFA Sessions established via stolen cookies bypass the MFA step entirely. Search for: Security EID 4624 Type 3/10 logons on internal servers that originate from the NetScaler Gateway but have NO corresponding RADIUS or SAML MFA log event within the preceding 5 minutes. Authentication without MFA through a gateway that requires MFA is the indicator. Security EID 4624 Type 3/10 · RADIUS/SAML logs: missing MFA event correlation
  4. 4. Check for post-hijack lateral movement Once inside via the hijacked session, attackers move laterally using the authenticated identity. Check for: RDP or SMB connections from the NetScaler's internal SNIP to targets the legitimate user doesn't normally access, credential dumping, and ransomware staging. Compromised Credentials playbook · Ransomware playbook
Related playbooks

Edge Device Compromised (NetScaler is an edge device)
Compromised Credentials (session hijack is credential compromise without the credential)
RaaS Ecosystem (LockBit industrialized Citrix Bleed)