Citrix ADC Proxy Logs: CVE-2023-4966 Sensitive Info Disclosure Probe via OIDC Configuration Request

Alerts on successful GETs to /oauth/idp/.well-known/openid-configuration in Citrix ADC proxy logs consistent with CVE-2023-4966 probing.

FreeUnreviewedSigmamediumv1

citrix-adc-proxy-logs-cve-2023-4966-sensitive-info-disclosure-probe-via-oidc-con-ff349b81

title: "Citrix ADC Proxy Logs: CVE-2023-4966 Sensitive Info Disclosure Probe via OIDC Configuration Request"
id: a987f73c-a596-42c7-ac89-e78728574dab
related:
  - id: 87c83d8e-5390-44ce-aa4a-d3b37e54d0a0
    type: similar
  - id: aee7681f-b53d-4594-a9de-ac51e6ad3362
    type: similar
  - id: a4e068b5-e27c-4f21-85b3-e69e5a4f7ce1
    type: similar
  - id: ff349b81-617f-4af4-924f-dbe8ea9bab41
    type: derived
status: test
description: This rule flags HTTP GET requests to the OIDC well-known endpoint on Citrix ADC/NetScaler Gateway paths, matching the specific URI fragment used in CVE-2023-4966 sensitive information disclosure attempts. Attackers may query this configuration to obtain sensitive data or facilitate further exploitation. The detection relies on proxy telemetry fields including HTTP method, the presence of the target URI substring, and a successful 200 response status.
references:
  - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
  - https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
  - https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml
author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (STRT), Huntrule Team
date: 2023-11-28
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-4966
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    cs-uri|contains: /oauth/idp/.well-known/openid-configuration
    sc-status: 200
  condition: selection
falsepositives:
  - Vulnerability scanners
level: medium
license: DRL-1.1

What it detects

This rule flags HTTP GET requests to the OIDC well-known endpoint on Citrix ADC/NetScaler Gateway paths, matching the specific URI fragment used in CVE-2023-4966 sensitive information disclosure attempts. Attackers may query this configuration to obtain sensitive data or facilitate further exploitation. The detection relies on proxy telemetry fields including HTTP method, the presence of the target URI substring, and a successful 200 response status.

Known false positives

Vulnerability scanners

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.