Citrix Bleed 2 Flaw Enables Token Theft; SAP GUI Flaws Risk Sensitive Data Exposure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-4966 | Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway Citrix NetScaler ADC and NetScaler Gateway appliances contain a buffer overflow (CWE-119) that leaks sensitive information from device memory when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. A remote attacker who can reach such a configuration can trigger the overflow and read memory contents, harvesting sensitive data such as session tokens (a technique that enables session hijacking which can bypass multi-factor authentication). Any organization running an affected NetScaler ADC or Gateway appliance in these configurations is exposed, with appliances deployed as VPN or access gateways being the primary concern. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2023-10-18 with known ransomware use and a 100% EPSS exploitation probability, although no public proof-of-concept is known at this time. Because tokens stolen from memory can remain valid even after patching, responders must terminate all active and persistent sessions as part of remediation. Do: Upgrade affected appliances to the patched builds cited in Citrix's advisory, then immediately kill all active and persistent ICA/AAA sessions per the vendor instructions, since patching alone does not invalidate session tokens attackers may have already stolen. If patching is not immediately possible, discontinue use of the affected Gateway/AAA configurations as CISA directs. Given known ransomware abuse, also hunt for signs of exploitation such as logins from unexpected sources, anomalous session reuse, or suspicious mailbox changes, and reset credentials for potentially exposed accounts. | 7.5 | 100% | KEV ransomware |
| masshundreds of thousands of internet-exposed NetScaler ADC/Gateway appliances (public internet scan counts), plus an unknown number of VPN-only or internal… | |
| CVE-2025-0055 | SAP GUI for Windows stores user input on the client PC to improve usability. SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application. NVD description · AI analysis pending | 6.0 | <1% | — | — | ||
| CVE-2025-0056 | SAP GUI for Java saves user input on the client PC to improve usability. SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application. NVD description · AI analysis pending | 6.0 | <1% | — | — | ||
| CVE-2025-0059 | Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application. NVD description · AI analysis pending | 6.0 | <1% | — | — | ||
| CVE-2025-5777 | Out-of-Bounds Read (Memory Overread) in Citrix NetScaler ADC and Gateway Citrix NetScaler ADC and NetScaler Gateway contain an out-of-bounds read (CWE-125) caused by insufficient input validation, which can cause the appliance to read beyond the intended memory buffer (a memory overread). The flaw is only triggerable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, so attackers who can reach those services can potentially induce the overread and obtain sensitive memory contents. Such disclosure could aid follow-on compromise, for example by exposing session or authentication data, and CISA notes known ransomware use. Organizations running NetScaler ADC or NetScaler Gateway in the affected Gateway/AAA configurations are exposed. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-07-10 with known ransomware use and an EPSS of 100% (100th percentile), indicating active exploitation, while no public PoC is known and a CVSS score has not yet been assigned. Do: Apply the fixed NetScaler ADC/Gateway builds per Citrix's security advisory (exact affected/fixed version ranges are not in the available data, so consult the bulletin); per CISA KEV, apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Inventory appliances for Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server configurations, since unconfigured/other deployments are not triggerable. After patching, terminate active and idle VPN sessions and hunt for anomalous access, given the known ransomware exploitation and the information-disclosure nature of the flaw. | 9.3 | 100% | KEV ransomware |
| massplausibly hundreds of thousands of installed/internet-exposed NetScaler ADC and Gateway appliances (public scans have historically shown on the order of… |
Full article953 words · extracted from thehackernews.com · click to collapse
Cybersecurity researchers have detailed two now-patched security flaws in SAP Graphical User Interface (GUI) for Windows and Java that, if successfully exploited, could have enabled attackers to access sensitive information under certain conditions.
The vulnerabilities, tracked as CVE-2025-0055 and CVE-2025-0056 (CVSS scores: 6.0), were patched by SAP as part of its monthly updates for January 2025.
"The research discovered that SAP GUI input history is stored insecurely, both in the Java and Windows versions," Pathlock researcher Jonathan Stross said in a report shared with The Hacker News.
SAP GUI user history allows users to access previously entered values in input fields with the goal of saving time and reducing errors. This historical information is stored locally on devices. This can include usernames, national IDs, social security numbers (SSNs), bank account numbers, and internal SAP table names.
The vulnerabilities identified by Pathlock are rooted in this input history feature, allowing an attacker with administrative privileges or access to the victim's user directory on the operating system to access the data within a predefined directory based on the SAP GUI variant.
- SAP GUI for Windows - %APPDATA%\LocalLow\SAPGUI\Cache\History\SAPHistory<WINUSER>.db
- SAP GUI for Java - %APPDATA%\LocalLow\SAPGUI\Cache\History or $HOME/.SAPGUI/Cache/History (Windows or Linux) and $HOME/Library/Preferences/SAP/Cache/History (macOS)
The issue is that the inputs are saved in the database file using a weak XOR-based encryption scheme in the case of SAP GUI for Windows, which makes them trivial to decode with minimal effort. In contrast, SAP GUI for Java stores these historical entries in an unencrypted fashion as Java serialized objects.
As a result, depending on the user input provided in the past, the disclosed information could include anything between non-critical data to highly sensitive data, thereby impacting the confidentiality of the application.
"Anyone with access to the computer can potentially access the history file and all sensitive information it stores," Stross said. "Because the data is stored locally and weakly (or not at all) encrypted, exfiltration through HID injection attacks (like USB Rubber Ducky) or phishing becomes a real threat."
Pathlock also pointed out the two vulnerabilities served as a foundation for a third information disclosure flaw (CVE-2025-0059, CVSS score: 6.0) in SAP NetWeaver Application Server ABAP, which is based on SAP GUI for HTML. However, it does not have a patch.
To mitigate any potential risks associated with information disclosure, it's advised to disable the input history functionality and delete existing database or serialized object files from the aforementioned directories.
Citrix Patches CVE-2025-5777
The disclosure comes as Citrix patched a critical-rated security flaw in NetScaler ADC (CVE-2025-5777, CVSS score: 9.3) that could be exploited by threat actors to gain access to susceptible appliances.
The shortcoming stems from insufficient input validation that may enable unauthorized attackers to grab valid session tokens from memory via malformed requests, effectively bypassing authentication protections. However, this only works when Netscaler is configured as a Gateway or AAA virtual server.
The vulnerability has been codenamed Citrix Bleed 2 by security researcher Kevin Beaumont, owing to its similarities to CVE-2023-4966 (CVSS score: 9.4), which came under active exploitation in the wild two years ago.
It has been addressed in the following versions -
- NetScaler ADC and NetScaler Gateway 14.1-43.56 and later releases
- NetScaler ADC and NetScaler Gateway 13.1-58.32 and later releases of 13.1
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.235 and later releases of 13.1-FIPS and 13.1-NDcPP
- NetScaler ADC 12.1-FIPS 12.1-55.328 and later releases of 12.1-FIPS
Secure Private Access on-prem or Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities. Citrix is recommending that users run the following commands to terminate all active ICA and PCoIP sessions after all NetScaler appliances have been upgraded -
kill icaconnection -all
kill pcoipConnection -all
The company is also urging customers of NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 to move to a support version as they are now End Of Life (EOL) and no longer supported.
While there is no evidence that the flaw has been weaponized, watchTowr CEO Benjamin Harris said it "checks all the boxes" for attacker interest and that exploitation could be around the corner.
"CVE-2025-5777 is shaping up to be every bit as serious as CitrixBleed, a vulnerability that caused havoc for end-users of Citrix Netscaler appliances in 2023 and beyond as the initial breach vector for numerous high-profile incidents," Benjamin Harris, CEO at watchTowr, told The Hacker News.
"The details surrounding CVE-2025-5777 have quietly shifted since its initial disclosure, with fairly important pre-requisites or limitations being removed from the NVD CVE description -- specifically, the comment that this vulnerability was in the lesser-exposed Management Interface has now been removed -- leading us to believe that this vulnerability is significantly more painful than perhaps first signaled."
Update
ReliaQuest has revealed that it has "observed indications of exploitation" of CVE-2025-5777 to obtain initial access to target networks.
This includes hijacked Citrix web sessions from the NetScaler device, with authentication granted without user knowledge, indicating MFA bypass. The cybersecurity company also said it detected the below behavior -
- Session reuse across multiple IPs, including combinations of expected and suspicious IP addresses
- LDAP queries associated with Active Directory reconnaissance activities
- Multiple instances of the "ADExplorer64.exe" tool across the environment that have been used to query domain-level groups and permissions, as well as multiple domain controllers
- Citrix sessions originating from data-center-hosting IP addresses, including those associated with DataCamp, alluding to the use of consumer VPN services
Beaumont, in a post shared on Mastodon, pointed out that if the vulnerability is being exploited, the attacks are "probably" conducted by a ransomware group.
(The story was updated after publication with insights from ReliaQuest.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/06/citrix-bleed-2-flaw-enables-token-theft.html