Webserver logs: Detect CVE-2023-4966 probing on Citrix ADC/NetScaler OIDC endpoint

Alerts on successful GET requests to the OIDC openid-configuration path that match CVE-2023-4966 related probing patterns.

FreeUnreviewedSigmamediumv1

webserver-logs-detect-cve-2023-4966-probing-on-citrix-adc-netscaler-oidc-endpoin-87c83d8e

title: "Webserver logs: Detect CVE-2023-4966 probing on Citrix ADC/NetScaler OIDC endpoint"
id: 550e15fb-a888-47ce-a78b-9761f9b5ce73
related:
  - id: ff349b81-617f-4af4-924f-dbe8ea9bab41
    type: similar
  - id: aee7681f-b53d-4594-a9de-ac51e6ad3362
    type: similar
  - id: a4e068b5-e27c-4f21-85b3-e69e5a4f7ce1
    type: similar
  - id: 87c83d8e-5390-44ce-aa4a-d3b37e54d0a0
    type: derived
status: test
description: This rule flags webserver requests where the HTTP method is GET and the requested URI stem contains /oauth/idp/.well-known/openid-configuration, returning HTTP status 200. Such probing can indicate an attempt to access or leverage sensitive information disclosure behaviors associated with CVE-2023-4966 against Citrix ADC and NetScaler Gateway. Detection relies on webserver telemetry fields for request method, URI stem, and response status captured in access logs.
references:
  - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
  - https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
  - https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml
author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (STRT), Huntrule Team
date: 2023-11-28
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-4966
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    cs-uri-stem|contains: /oauth/idp/.well-known/openid-configuration
    sc-status: 200
  condition: selection
falsepositives:
  - Vulnerability scanners
level: medium
license: DRL-1.1

What it detects

This rule flags webserver requests where the HTTP method is GET and the requested URI stem contains /oauth/idp/.well-known/openid-configuration, returning HTTP status 200. Such probing can indicate an attempt to access or leverage sensitive information disclosure behaviors associated with CVE-2023-4966 against Citrix ADC and NetScaler Gateway. Detection relies on webserver telemetry fields for request method, URI stem, and response status captured in access logs.

Known false positives

Vulnerability scanners

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.