The vulnerability is identified as CVE-2023-4966 and has a CVSS score of 9.4 (Critical).
Unauthenticated attackers can leak memory that might include authentication session cookies from vulnerable Citrix NetScaler ADC and NetScaler Gateway appliances.
The vulnerability is caused by a flaw in the implementation of the OpenID Connect Discovery endpoint.
Assetnote diffed the patch and found the culprit: the response length came straight from the return value of snprintf, so a long Host header pushed the JSON past its 0x20000-byte buffer and the appliance happily sent whatever sat behind it.
Safer than sprintf, still a buffer over-read.
A public Python exploit built on that research pulls session tokens from Gateway and AAA virtual servers, for a single target or a whole list.
Its author, Chocapikk, noticed during their research that the session cookies always ended with the hex sequence 45525d5f4f58455e445a4a42, which makes leaked tokens easier to pick out of the dump.
Organizations are advised to update their vulnerable Citrix NetScaler ADC and NetScaler Gateway appliances as soon as possible.
