Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Tuesday, 26-Aug-2025 21:28:30 JST Kevin Beaumont

   There’s a bunch of new Netscaler vulns being exploited as zero days. Patches just out now.

   Preauth RCE being used to drop webshells to backdoor orgs. CVE-2025-7775 is the main problem.

   Orgs will need to do IR afterwards as technical details emerge of backdoor.

   https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938&articleTitle=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2025_7775_CVE_2025_7776_and_CVE_2025_8424

   • Embed this notice
     tehfishman (tehfishman@ioc.exchange)'s status on Tuesday, 26-Aug-2025 21:58:38 JST tehfishman

     in reply to

     @GossiTheDog cve 7775 instead of 5777. Practically manufactured to be easy to get confused.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Tuesday, 26-Aug-2025 22:05:57 JST Kevin Beaumont

     in reply to

     Must be Tuesday.

   • Embed this notice
     Ciarán (mc) (ciaranmak@mastodon.ie)'s status on Tuesday, 26-Aug-2025 22:30:33 JST Ciarán (mc)

     in reply to

     @GossiTheDog These arent the CISA ones from yesterday 🫣

   • Embed this notice
     Catalin Cimpanu (campuscodi@mastodon.social)'s status on Tuesday, 26-Aug-2025 22:35:42 JST Catalin Cimpanu

     • tehfishman

     @GossiTheDog @tehfishman so... the DeelbXirtic vulnerability?

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 27-Aug-2025 04:06:56 JST Kevin Beaumont

     in reply to

     Internet scanning for hosts vulnerable to CVE-2025-7775 (CitrixDeelb) has begun, will put up results tomorrow or Friday.

   • Embed this notice
     ⠠⠵ avuko (avuko@infosec.exchange)'s status on Wednesday, 27-Aug-2025 04:17:19 JST ⠠⠵ avuko

     in reply to

     @GossiTheDog pretty please, not Friday.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 27-Aug-2025 06:20:28 JST Kevin Beaumont

     in reply to

     16% patch rate, 84% unpatched if anybody interested

   • Embed this notice
     Various_Canaries (various_canaries@cyberplace.social)'s status on Wednesday, 27-Aug-2025 08:26:12 JST Various_Canaries

     in reply to

     @GossiTheDog ouch

   • Embed this notice
     Bildos (bildos@cyberplace.social)'s status on Wednesday, 27-Aug-2025 22:36:30 JST Bildos

     in reply to

     @GossiTheDog where I can find 7775 scan python script ?

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 28-Aug-2025 00:46:01 JST Kevin Beaumont

     in reply to

     • Shodan

     Citrix Netscaler boxes presented to the internet over time, for anybody interested, pulled via @shodan

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 28-Aug-2025 03:52:50 JST Kevin Beaumont

     in reply to

     The NCSC have published an advisory on CVE-2025-7775 (CitrixDeelb), saying it is highly likely it will be mass exploited:

     https://advisories.ncsc.nl/2025/ncsc-2025-0268.html

     They've also published a script to check for post exploitation, i.e. backdoor access which persists post patching: https://github.com/NCSC-NL/citrix-2025/blob/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 28-Aug-2025 03:54:54 JST Kevin Beaumont

     in reply to

     Cloud Software Group, who own Netscaler, have published their own blog about CVE-2025-7775 (CitrixDeelb)

     https://www.netscaler.com/blog/news/critical-security-update-announced-for-netscaler-gateway-and-netscaler/

     ...however they've incorrectly said it applies to IPv6 setups only. This is wrong. They've missed the "OR" statements from their own advisory.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 28-Aug-2025 03:57:07 JST Kevin Beaumont

     in reply to

     Here's the Citrix advisory, if anybody knows anybody at Cloud Software Group please get them to correct the blog post - it's a repeat of the CitrixBleed 2 situation again where the wrong information has been published to customers again.

   • Embed this notice
     faebudo (faebudo@ioc.exchange)'s status on Thursday, 28-Aug-2025 05:56:24 JST faebudo

     in reply to

     @GossiTheDog As a non-native english speaker I understand "several independent preconditions" as "any of the following conditions can be true to fulfill the prerequisites for it to be exploitable".

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 28-Aug-2025 17:58:01 JST Kevin Beaumont

     in reply to

     I've published scan results for CVE-2025-7775 (CitrixDeelb - which Bleed is spelt backwards as the CVE number is reverse of CitrixBleed2 :catjam: )

     Columns = IP, SSL hostnames, firmware version, vulnerable to CVE-2025-7775 exploitation.

     https://raw.githubusercontent.com/GossiTheDog/scanning/refs/heads/main/CVE-2025-7775-Citrix-Netscaler.csv

   • Embed this notice
     brummelbär (brummelbaer@infosec.exchange)'s status on Thursday, 28-Aug-2025 19:55:52 JST brummelbär

     in reply to

     • Marius
     • FL | エフル

     @fl @fere @GossiTheDog Same here, but that's to be expected in an evolving situation

   • Embed this notice
     Marius (fere@infosec.exchange)'s status on Thursday, 28-Aug-2025 19:55:53 JST Marius

     in reply to

     @GossiTheDog These results are atleast 20 hours old? I can confirm one hit on your list is in fact patched.

   • Embed this notice
     FL | エフル (fl@infosec.exchange)'s status on Thursday, 28-Aug-2025 19:55:53 JST FL | エフル

     in reply to

     • Marius

     @fere @GossiTheDog same thing, some entries in the list are either false positive or the scan is old

   • Embed this notice
     brummelbär (brummelbaer@infosec.exchange)'s status on Thursday, 28-Aug-2025 21:38:03 JST brummelbär

     • Marius
     • FL | エフル

     @GossiTheDog @fl @fere That's great, thank you! Does anybody know if there are some IOCs out there or some additional details for the already exploited instances that would help in a compromise assessment?

   • Embed this notice
     Just_Patch_It (just_patch_it@cyberplace.social)'s status on Friday, 29-Aug-2025 02:13:25 JST Just_Patch_It

     in reply to

     @GossiTheDog how did you pull the versions?

   • Embed this notice
     lfzz (lfzz@mastodon.social)'s status on Friday, 29-Aug-2025 05:35:44 JST lfzz

     in reply to

     @GossiTheDog what is going to happen now that every permutation and bad word play of ctrix bleed had been used? I can't keep calling people ask what did they do about citrix vulnerability. Its not even funny.

   • Embed this notice
     Face Thumb (chrisp@cyberplace.social)'s status on Saturday, 30-Aug-2025 08:16:57 JST Face Thumb

     @GossiTheDog That gif is udderly ridiculous

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 01-Sep-2025 00:31:48 JST Kevin Beaumont

     Updated scan results for CVE-2025-7775 aka CitrixDeelb

     https://github.com/GossiTheDog/scanning/blob/main/CVE-2025-7775-Citrix-Netscaler.csv

     Next results probably Tuesday

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 01-Sep-2025 22:50:39 JST Kevin Beaumont

     in reply to

     • The Shadowserver Foundation

     .@shadowserver results on CVE-2025-7775 patchin'

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Monday, 01-Sep-2025 23:10:07 JST Kevin Beaumont

     in reply to

     A kind of interesting thing from scanning Netscalers for the past month and a bit is the number that have gone offline - it's down over a thousand boxes month on month.

     GreenSkyOverMe (Monika) repeated this.
   • Embed this notice
     fosec (fosec@infosec.exchange)'s status on Monday, 01-Sep-2025 23:20:43 JST fosec

     in reply to

     @GossiTheDog Do the network scans accurately find NetScalers if the ADC is configured for SAML and immediately redirects to the SSO login page?

   • Embed this notice
     Eckes :mastodon: (eckes@zusammenkunft.net)'s status on Tuesday, 02-Sep-2025 01:31:08 JST Eckes :mastodon:

     in reply to

     @GossiTheDog or they hide the signature as they notice they are exposed and get outcalled. But it is likely that Infrastructure More and more moves to the Cloud?

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Tuesday, 02-Sep-2025 19:53:21 JST Kevin Beaumont

     in reply to

     Updated scan results for CVE-2025-7775 aka CitrixDeelb

     https://github.com/GossiTheDog/scanning/blob/main/CVE-2025-7775-Citrix-Netscaler.csv

     Next results Thursday

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Tuesday, 02-Sep-2025 20:02:13 JST Kevin Beaumont

     in reply to

     If anybody is wondering the NSA patched CitrixDeelb pretty quickly. They've made some changes to stop scanning, but they'll be back in the next results.

     103.41.70.207,vdicorp.nsa.gov,13.1-59.22,Wed, 20 Aug 2025 12:26:13 GMT,NOT_VULNERABLE

     Re: https://cyberplace.social/@GossiTheDog/114823552387000273

   • Embed this notice
     Dave Pimlott (quikkie@infosec.exchange)'s status on Tuesday, 02-Sep-2025 22:26:22 JST Dave Pimlott

     in reply to

     @GossiTheDog 13.1 is EOL for over a year. The public announcement said that 13.1 was vulnerable and that no 13.1 patches were being released so I'm surprised to see an ADC running 13.1 that is listed as not vulnerable or is that an artifact of the changes that the NSA made?

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 03-Sep-2025 21:58:07 JST Kevin Beaumont

     in reply to

     This blog by CheckPoint about AI LLM generating an exploit for CVE-2025-7775 is complete bollocks - it’s a bunch of fan fiction.

     The threat actor was talking about an old Netscaler vuln.

     https://blog.checkpoint.com/executive-insights/hexstrike-ai-when-llms-meet-zero-day-exploitation/

   • Embed this notice
     Yun (yun@infosec.exchange)'s status on Friday, 05-Sep-2025 01:44:19 JST Yun

     in reply to

     • Just_Patch_It

     @Just_Patch_It @GossiTheDog I maintain the NetScaler version info here: https://github.com/fox-it/citrix-netscaler-triage/blob/main/scan-citrix-netscaler-version.py

   • Embed this notice
     Just_Patch_It (just_patch_it@cyberplace.social)'s status on Friday, 05-Sep-2025 01:44:21 JST Just_Patch_It

     in reply to

     @GossiTheDog Bump

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 05-Sep-2025 03:04:15 JST Kevin Beaumont

     Updated scan results for CVE-2025-7775 aka CitrixDeelb

     https://github.com/GossiTheDog/scanning/blob/main/CVE-2025-7775-Citrix-Netscaler.csv

     Next (and probably final) results Saturday