NexurAI
Two eras of Citrix pain: the 2019 ADC path traversal and 2023's Citrix Bleed.
A path-traversal flaw in Citrix ADC allows unauthenticated remote code execution on the appliance - a favorite ransomware entry point.
Citrix ADC / Gateway (NetScaler) · 2019
The attacker uses '/vpn/../vpns/' path traversal to reach a vulnerable template endpoint and write/execute a payload, gaining code execution on the appliance.
Alert on requests containing '/vpn/../vpns/' or to /vpns/portal/scripts/, new .xml/.pl files in the template dir, and unexpected processes on the appliance.
Patch the appliance, apply Citrix's mitigation, and forensically review for implants (appliances are often not re-imaged).
A buffer over-read leaks session tokens from NetScaler memory, letting attackers hijack authenticated sessions and bypass MFA.
Citrix NetScaler ADC / Gateway · 2023
The attacker sends a crafted request to over-read memory, harvests valid session cookies, and replays them to impersonate users without credentials or MFA.
Hunt for session reuse from new IPs/user-agents, impossible-travel logins, and large or malformed requests to the NetScaler; correlate with VPN session anomalies.
Patch NetScaler, then terminate ALL active sessions (patching alone does not evict stolen tokens), and review for post-exploitation activity.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.