Citrix ADC Proxy GET to OAuth OpenID Configuration with Excessive Host Header Length (CVE-2023-4966)

title: Citrix ADC Proxy GET to OAuth OpenID Configuration with Excessive Host Header Length (CVE-2023-4966)
id: 3ac95f84-9937-48d9-9ef7-de3211bfb59c
related:
  - id: 87c83d8e-5390-44ce-aa4a-d3b37e54d0a0
    type: similar
  - id: ff349b81-617f-4af4-924f-dbe8ea9bab41
    type: similar
  - id: a4e068b5-e27c-4f21-85b3-e69e5a4f7ce1
    type: similar
  - id: aee7681f-b53d-4594-a9de-ac51e6ad3362
    type: derived
status: test
description: This rule identifies potential exploitation attempts of CVE-2023-4966 against Citrix ADC and NetScaler Gateway by matching proxy HTTP requests. It looks for GET requests accessing the OpenID configuration path while requiring a very long host header value. Attackers may use this malformed or oversized host header behavior to trigger a sensitive information disclosure condition. Detection relies on proxy telemetry fields for the HTTP method, requested URI, and the host header length/content.
references:
  - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
  - https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
  - https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-28
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-4966
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    cs-uri|contains: /oauth/idp/.well-known/openid-configuration
    cs-host|re: .{150}
  condition: selection
falsepositives:
  - Vulnerability scanners
level: high
license: DRL-1.1