Citrix ADC CVE-2023-4966 Proxy Exploitation Attempt via Oversized Host Header (GET /oauth idp well-known)
Flags proxy GETs to the OpenID configuration endpoint with an excessively long Host header consistent with CVE-2023-4966 probing.
- Category
- proxy
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-11-28
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags HTTP GET requests in proxy telemetry where the request path contains '/oauth/idp/.well-known/openid-configuration' and the Host header matches a pattern indicating an unusually long host value. Such oversized Host header strings are used in attempts to trigger sensitive information disclosure behavior associated with CVE-2023-4966 on Citrix ADC/NetScaler Gateway. It relies on proxy logs capturing the HTTP method, URI, and Host header values for pattern matching.
Reporting behind it
- support.citrix.comhttps://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
- attackerkb.comhttps://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
- rapid7.comhttps://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
- assetnote.iohttps://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
- github.comhttps://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Citrix ADC CVE-2023-4966 Proxy Exploitation Attempt via Oversized Host Header (GET /oauth idp well-known)
id: 3ac95f84-9937-48d9-9ef7-de3211bfb59c
related:
- id: 87c83d8e-5390-44ce-aa4a-d3b37e54d0a0
type: similar
- id: ff349b81-617f-4af4-924f-dbe8ea9bab41
type: similar
- id: a4e068b5-e27c-4f21-85b3-e69e5a4f7ce1
type: similar
- id: aee7681f-b53d-4594-a9de-ac51e6ad3362
type: derived
status: test
description: This rule flags HTTP GET requests in proxy telemetry where the request path contains '/oauth/idp/.well-known/openid-configuration' and the Host header matches a pattern indicating an unusually long host value. Such oversized Host header strings are used in attempts to trigger sensitive information disclosure behavior associated with CVE-2023-4966 on Citrix ADC/NetScaler Gateway. It relies on proxy logs capturing the HTTP method, URI, and Host header values for pattern matching.
references:
- https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
- https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
- https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
- https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
- https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-28
tags:
- attack.initial-access
- attack.t1190
- cve.2023-4966
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: GET
cs-uri|contains: /oauth/idp/.well-known/openid-configuration
cs-host|re: .{150}
condition: selection
falsepositives:
- Vulnerability scanners
level: high
license: DRL-1.1