Webserver logs: Possible CVE-2023-4966 probing on Citrix ADC via long Host header

title: "Webserver logs: Possible CVE-2023-4966 probing on Citrix ADC via long Host header"
id: a52eb475-8fba-435f-831a-b0d25d41be54
related:
  - id: 87c83d8e-5390-44ce-aa4a-d3b37e54d0a0
    type: similar
  - id: ff349b81-617f-4af4-924f-dbe8ea9bab41
    type: similar
  - id: aee7681f-b53d-4594-a9de-ac51e6ad3362
    type: similar
  - id: a4e068b5-e27c-4f21-85b3-e69e5a4f7ce1
    type: derived
status: test
description: This rule flags HTTP GET requests targeting the OpenID configuration path while presenting an unusually long Host header value. Attackers may probe Citrix ADC/NetScaler Gateway for sensitive information disclosure by crafting requests that trigger the vulnerability. The detection relies on webserver telemetry capturing request method, URI stem contents, and host header length/pattern matching.
references:
  - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
  - https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
  - https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-28
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-4966
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    cs-uri-stem|contains: /oauth/idp/.well-known/openid-configuration
    cs-host|re: .{150}
  condition: selection
falsepositives:
  - Vulnerability scanners
level: high
license: DRL-1.1