High confidence Citrix NetScaler CitrixBleed memory overread via oversized Host header - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects the CVE-2023-4966 CitrixBleed exploitation primitive: a GET request to either the IdP or RP NetScaler Gateway/AAA OpenID Connect Discovery endpoint carrying an abnormally long Host header, or a response from that same endpoint far larger than the legitimate discovery document, consistent with a buffer overread in the nsppe binary leaking uninitialized memory including valid NSC_AAAC session cookies. No legitimate client or DNS-resolvable hostname produces a Host header anywhere near this length. Also matches the HTTP/2 ":authority" pseudo-header when a log pipeline captures it separately from Host. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Détecte la primitive d'exploitation de CVE-2023-4966 (CitrixBleed) : une requête GET vers l'endpoint OpenID Connect Discovery IdP ou RP de Citrix NetScaler Gateway/AAA avec un en-tête Host anormalement long, ou une réponse de ce même endpoint bien plus volumineuse que le document de découverte légitime, cohérent avec une lecture hors limites dans le binaire nsppe qui fuit de la mémoire non initialisée incluant des cookies de session NSC_AAAC valides. Aucun client légitime ni nom d'hôte résolvable en DNS ne produit un en-tête Host de cette longueur. Couvre également le pseudo-en-tête HTTP/2 ":authority" lorsqu'un pipeline de logs le capture séparément du champ Host. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: High confidence Citrix NetScaler CitrixBleed memory overread via oversized Host header - STRICT
id: a9002b8f-fd5e-471e-a2f9-b29150ada58e
status: experimental
description: |
Detects the CVE-2023-4966 CitrixBleed exploitation primitive: a GET request to either the IdP or RP NetScaler Gateway/AAA OpenID Connect Discovery endpoint carrying an abnormally long Host header, or a response from that same endpoint far larger than the legitimate discovery document, consistent with a buffer overread in the nsppe binary leaking uninitialized memory including valid NSC_AAAC session cookies. No legitimate client or DNS-resolvable hostname produces a Host header anywhere near this length. Also matches the HTTP/2 ":authority" pseudo-header when a log pipeline captures it separately from Host. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Détecte la primitive d'exploitation de CVE-2023-4966 (CitrixBleed) : une requête GET vers l'endpoint OpenID Connect Discovery IdP ou RP de Citrix NetScaler Gateway/AAA avec un en-tête Host anormalement long, ou une réponse de ce même endpoint bien plus volumineuse que le document de découverte légitime, cohérent avec une lecture hors limites dans le binaire nsppe qui fuit de la mémoire non initialisée incluant des cookies de session NSC_AAAC valides. Aucun client légitime ni nom d'hôte résolvable en DNS ne produit un en-tête Host de cette longueur. Couvre également le pseudo-en-tête HTTP/2 ":authority" lorsqu'un pipeline de logs le capture séparément du champ Host. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://www.cve.org/CVERecord?id=CVE-2023-4966
- https://nvd.nist.gov/vuln/detail/CVE-2023-4966
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX579459
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-07
modified: 2026-08-07
tags:
- attack.initial-access
- attack.credential-access
- attack.t1190
- attack.t1550.004
- cve.2023-4966
logsource:
category: webserver
definition: >
Web server, WAF, reverse-proxy or Citrix NetScaler AAA access logs. Expected fields:
Url, HttpMethod, Host, ResponseBytes. Field names vary by log source; adapt Host to the
local pipeline if the raw request header is captured under a different name
(e.g. http.request.header.host, request_host_header).
detection:
selection_endpoint:
Url|contains:
- '/oauth/idp/.well-known/openid-configuration'
- '/oauth/rp/.well-known/openid-configuration'
selection_method:
HttpMethod: GET
selection_oversized_host_header:
Host|re: '.{513,}'
selection_oversized_authority_pseudo_header:
Authority|re: '.{513,}'
selection_anomalous_response_size:
ResponseBytes|gt: 20000
condition: selection_endpoint and selection_method and (selection_oversized_host_header or selection_oversized_authority_pseudo_header or selection_anomalous_response_size)
fields:
- SourceIp
- DestinationIp
- DestinationPort
- HttpMethod
- Url
- Host
- Authority
- StatusCode
- ResponseBytes
- Cookie
falsepositives:
- None identified for the oversized Host header signal. Valid DNS hostnames cannot legally exceed 253 characters, so any Host value above 512 bytes has no legitimate origin.
- Misconfigured internal reverse-proxy chains that concatenate multiple hostnames into a single Host or X-Forwarded-Host value could theoretically approach this threshold; verify proxy configuration before dismissing an alert on this basis.
- The response-size signal alone can be affected by unrelated large error pages on the same endpoint; treat single-selection matches on selection_anomalous_response_size without the oversized header as medium-priority pending manual review.
level: high