Saint Citrix Bleed, Who Leaked the Session Tokens

Patron of NetScaler gateways, session tokens dripping from memory, and those who learn too late that someone is already inside.

Life

On 24 October 2023 Assetnote explained Citrix Bleed in detail: send a malformed request to a NetScaler configured as a gateway, and the device returned chunks of memory containing users' session tokens. With those tokens an attacker stepped over passwords and multi-factor authentication and sat down in other people's sessions. Exploited at scale, ransomware groups among them, it became one of the most famous bugs of the year.

Prayer

O Saint Citrix Bleed, who makes tokens drip like blood from a wound, let our gateways keep in memory only what is needed. Amen.

How to celebrate

Celebrated by updating NetScaler and terminating all active sessions, because the patch does not evict whoever already stole a token.

A wound that leaks tokens is not closed by the patch alone.