This pre-authentication flaw enables attackers to craft malicious requests that leak uninitialized memory from affected NetScaler ADC and Gateway devices, potentially exposing sensitive data, including session tokens, passwords, and configuration values. CVE-2025-5777 affects Citrix NetScaler devices, allowing unauthenticated attackers to leak sensitive memory data including session tokens and passwords. The oversized User-Agent header injects distinctive markers like “THR-WAF-RESEARCH” into the stack, which subsequently appear within <InitialValue> XML tags in HTTP responses, confirming successful memory disclosure and revealing sensitive information. The technique earned the “CitrixBleed” moniker because attackers can repeatedly trigger memory leaks by sending identical payloads, with each attempt exposing new chunks of stack memory. Since the underlying code is written in C/C++, which doesn’t automatically initialize variables, attackers can access random stack memory containing leftover data from previous operations. Attackers send crafted requests with large User-Agent headers to trigger continuous memory leaks from the same target. The vulnerability has prompted immediate security responses from organizations worldwide, with over 200,000 scanning attempts detected within days of the proof-of-concept disclosure. The actual exploit involves sending crafted POST requests to the /p/u/doAuthentication.do endpoint with an unusually large User-Agent header containing recognizable patterns.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 11 Jul 2025 07:50:11 +0000