In October 2023, a memory leak in Citrix NetScaler ADC and NetScaler Gateway, tracked as CVE-2023-4966 and nicknamed CitrixBleed, let unauthenticated attackers read valid session cookies straight out of internet-facing appliances. A stolen cookie was a finished login: no username, no password and no MFA prompt. Within weeks, ransomware affiliates and other groups used it to get into Boeing's parts distribution business, the US arm of the Industrial and Commercial Bank of China (ICBC) and Comcast's Xfinity, among many others. CitrixBleed is the clearest recent example of why a session token is a credential in its own right, and why patching alone does not end an incident when tokens have already leaked.
Key takeaways
- Citrix disclosed CVE-2023-4966 on 10 October 2023. Mandiant later found it had been exploited as a zero-day since late August 2023.
- A crafted HTTP request made vulnerable appliances return memory containing a valid NetScaler AAA session cookie. Replaying it gave an authenticated session that bypassed passwords and MFA.
- Patching stopped new leaks but did not revoke sessions already stolen. Citrix told customers to kill all active and persistent sessions after upgrading.
- CISA and partners confirmed LockBit 3.0 affiliates used it against Boeing Distribution Inc. Comcast says attackers were inside Xfinity systems from 16 to 19 October 2023, after it had patched.
- Lessons: treat session tokens as credentials, revoke them when the issuing system is compromised, bind sessions to device and context, and alert on session reuse from new locations.
At a glance
| Organisations | Users of Citrix NetScaler ADC and NetScaler Gateway, including Boeing Distribution Inc., ICBC Financial Services and Comcast (Xfinity) |
|---|---|
| When | Zero-day exploitation from late August 2023; disclosed 10 October 2023; mass exploitation from late October; victim disclosures November to December 2023 |
| Attacker | Multiple groups, including LockBit 3.0 ransomware affiliates and four uncategorised clusters tracked by Mandiant |
| Entry point | Internet-facing NetScaler appliances configured as a gateway or AAA virtual server |
| Identities abused | Valid NetScaler AAA session cookies of legitimate users, replayed to hijack authenticated sessions without password or MFA |
| Impact | Ransomware and data theft at Boeing and ICBC; usernames and hashed passwords of about 35.9 million Xfinity customers accessed; nearly 300 organisations notified by CISA |
| Category | Human identity (not listed as an NHI or AI agent breach): session token theft from a vulnerable appliance |
What happened
NetScaler ADC and NetScaler Gateway sit at the edge of many corporate networks, handling remote access, VPN and single sign-on. On 10 October 2023, Citrix published a security bulletin for CVE-2023-4966, a critical information disclosure flaw rated CVSS 9.4. It affected appliances configured as a gateway (VPN virtual server, ICA proxy, CVPN or RDP proxy) or as an AAA virtual server. According to the joint CISA advisory, affected versions included 14.1 before 14.1-8.50, 13.1 before 13.1-49.15, 13.0 before 13.0-92.19 and the end-of-life 12.1 branch.
Mandiant published remediation guidance on 17 October and later reported that the flaw had been exploited as a zero-day since late August 2023. Its 31 October analysis explained why that mattered so much: "An attacker with access to a valid cookie can establish an authenticated session to the NetScaler appliance without knowledge of the username, password, or access to a multi-factor authentication token or device." Mandiant tracked four separate uncategorised groups exploiting the bug against legal and professional services, technology and government organisations in the Americas, EMEA and APJ.
On 23 October, Citrix updated customers: "We now have reports of incidents consistent with session hijacking, and have received credible reports of targeted attacks exploiting this vulnerability." It told them to upgrade and then kill all active and persistent sessions. Two days later, on 25 October, researchers at Assetnote published technical details and a proof of concept, and exploitation spread quickly. Security researcher Kevin Beaumont reported that "Most of the threat actors are using a Python script that then posts the stolen session keys to /logon/LogonPoint/Authentication/GetUserName".
Named victims followed. Boeing confirmed on 2 November 2023 that a cyber incident had hit "elements of our parts and distribution business" after LockBit listed it on its leak site. CISA's advisory of 21 November stated that "Boeing observed LockBit 3.0 affiliates exploiting CVE-2023-4966, to obtain initial access to Boeing Distribution Inc., its parts and distribution business that maintains a separate environment." Computer Weekly reported that about 40 GB of data was later published by LockBit.
In early November 2023, ICBC Financial Services, the US broker-dealer arm of the Chinese bank, was hit by ransomware that disrupted its clearing of US Treasury trades. Beaumont pointed out on 9 November that ICBC had an unpatched NetScaler appliance, and Computer Weekly reported on 15 November that the US Treasury had written to financial industry bodies reinforcing the view that the attack began through exploitation of vulnerabilities in the Citrix NetScaler product family. A person claiming to represent LockBit told Reuters that "ICBC has paid a ransom", a claim Computer Weekly noted was not verified. In December 2024, the SEC settled recordkeeping charges with ICBC Financial Services, finding it had been unable to keep current books and records between 8 November 2023 and 1 March 2024. No civil penalty was imposed.
Comcast's disclosure showed the limits of patching. Xfinity says it patched after Citrix's 10 October announcement, but "between October 16 and October 19, 2023, there was unauthorized access to some of our internal systems". It found the activity on 25 October, determined on 16 November that data was likely taken and concluded on 6 December that usernames and hashed passwords were involved. Cybersecurity Dive reported that about 35.9 million customers were affected.
Timeline
| Date | Event |
|---|---|
| Late August 2023 | Earliest zero-day exploitation identified by Mandiant. |
| 10 October 2023 | Citrix publishes the security bulletin and fixed builds for CVE-2023-4966. |
| 16 to 19 October 2023 | Unauthorised access to Xfinity internal systems. |
| 17 October 2023 | Mandiant publishes remediation recommendations for CVE-2023-4966. |
| 23 October 2023 | Citrix confirms session hijacking incidents and publishes session-kill guidance. |
| 25 October 2023 | Assetnote publishes technical details and a proof of concept; mass exploitation begins. |
| 2 November 2023 | Boeing confirms a cyber incident in its parts and distribution business. |
| 8 to 10 November 2023 | Ransomware disrupts ICBC Financial Services in the US; the SEC dates its recordkeeping failures from 8 November. |
| 21 November 2023 | CISA, FBI, MS-ISAC and ASD's ACSC publish joint advisory AA23-325A on LockBit's use of CitrixBleed. |
| December 2023 | Comcast discloses the Xfinity breach and forces password resets. |
| December 2024 | SEC settles recordkeeping charges with ICBC Financial Services. |
How it happened: the identity attack path
- A gateway that holds everyone's sessions. After a user signs in, with MFA where configured, the NetScaler issues a session cookie. From then on, that cookie alone proves who the user is.
- Memory disclosure. According to CISA, attackers sent a GET request with a crafted HTTP Host header, and a vulnerable appliance returned system memory that included "a valid NetScaler AAA session cookie".
- Session replay. The attacker presented the stolen cookie to the gateway and received an authenticated session as that user. CISA said the flaw let threat actors "bypass password requirements and multifactor authentication (MFA)".
- Inside the network. From the hijacked session, attackers reached internal applications and desktops. In the LockBit intrusions, CISA described PowerShell scripts and remote tools such as AnyDesk and Splashtop. Mandiant saw Active Directory enumeration, LSASS memory dumps and Mimikatz, which turned one hijacked session into many harvested credentials.
- Stolen sessions outlived the patch. Upgrading closed the leak but did not invalidate cookies already taken. That is why Citrix told customers to run commands such as
kill aaa session -allandclear lb persistentSessions, and why Xfinity was breached after patching.
Impact
- Boeing: LockBit affiliates got into Boeing Distribution Inc.; Boeing said the incident did not affect flight safety. About 40 GB of data was published, according to Computer Weekly.
- ICBC Financial Services: ransomware disrupted Treasury trade settlement, and the SEC later found months of recordkeeping failures.
- Comcast Xfinity: usernames and hashed passwords for all affected customers, and for some, names, contact details, the last four digits of Social Security numbers, dates of birth and security questions and answers. Cybersecurity Dive put the total at about 35.9 million customers.
- Wider exposure: CISA notified nearly 300 organisations running vulnerable devices, according to Computer Weekly.
What this means for identity security
CitrixBleed did not break MFA. It skipped it. MFA protects the moment of sign-in, and the session cookie issued afterwards carries the full weight of that authentication for as long as it lives. Anyone holding it is the user. When the system that stores those cookies leaks them, every user's strong authentication is reduced to a string an attacker can paste.
The second lesson is about incident response. Most teams treat "patched" as "closed". Here, stolen sessions stayed valid until they were explicitly killed, and at least one major victim was breached in the days between patching and full session revocation. Any compromise of an identity provider, gateway or token store should trigger token revocation, not just a software update.
The parallel with machine identities is direct. Session cookies, OAuth access tokens, API tokens and cloud session credentials are all bearer tokens: whoever presents them is trusted. Non-human identities rely on bearer tokens even more than people do, and rarely have a second factor at all. The same controls apply to both: short lifetimes, binding to device or workload, revocation on compromise and detection of reuse from unexpected places.
Recommendations
- Patch edge devices within days, then revoke. After upgrading a gateway, VPN or identity appliance with a session or token leak, terminate all active and persistent sessions and force re-authentication.
- Treat session tokens as credentials. Keep lifetimes short, bind sessions to client context where the platform supports it and alert when one session appears from two locations. Our Workforce Identity Security Guide covers session controls for people.
- Use phishing-resistant MFA, but do not rely on it alone. It protects sign-in, not sessions that already exist.
- Restrict remote tools and credential dumping. Allowlist remote management software and restrict PowerShell, as CISA recommends, and protect LSASS so one hijacked session cannot become domain-wide access.
- Protect privileged access behind the gateway. Require step-up authentication and just-in-time access for admin actions, as described in our Privileged Access Management Guide.
- Apply the same rules to machine tokens. Inventory where API and OAuth tokens live, shorten their lifetimes and revoke them when the issuing or storing system is compromised. See NHI Authentication Guide.
Frequently asked questions
What is CitrixBleed?
CitrixBleed is the nickname for CVE-2023-4966, a critical flaw in Citrix NetScaler ADC and NetScaler Gateway that let unauthenticated attackers read memory containing valid session cookies from internet-facing appliances.
How did CitrixBleed bypass MFA?
It did not attack the MFA step. Attackers stole the session cookie issued after a user had already signed in with MFA, then replayed it to get an authenticated session without a password or second factor.
Why were organisations breached after they patched?
Patching stopped new cookies leaking, but cookies stolen before the patch stayed valid. Citrix advised killing all active and persistent sessions after upgrading, and Comcast reports unauthorised access to Xfinity systems from 16 to 19 October 2023, after it had patched.
Related NHI Mgmt Group resources
Mass breach of SonicWall VPN accounts · Salt Typhoon used a Cisco flaw and stolen credentials · Okta breach · Human vs Non-Human Identity · NHI breaches timeline
How NHI Mgmt Group can help
Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers target sessions, tokens, service accounts, API keys and secrets. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.
References
- CISA: #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A) (21 November 2023)
- NetScaler: CVE-2023-4966, Critical security update now available for NetScaler ADC and NetScaler Gateway (23 October 2023)
- Mandiant (Google Cloud): Session hijacking via Citrix NetScaler CVE-2023-4966 (31 October 2023)
- Xfinity: Notice to customers of data security incident (December 2023)
- Cybersecurity Dive: Comcast's Xfinity discloses massive data breach linked to CitrixBleed vulnerability (December 2023)
- TechCrunch: Boeing confirms 'cyber incident' after ransomware gang claims data theft (2 November 2023)
- Computer Weekly: CISA reveals how LockBit hacked Boeing via Citrix Bleed (22 November 2023)
- Computer Weekly: US government reinforces ICBC hack link to Citrix Bleed (15 November 2023)
- CNBC: China's ICBC, the world's biggest bank, hit by cyberattack that reportedly disrupted Treasury markets (10 November 2023)
- SEC: SEC Settles Recordkeeping Charges with ICBC Financial Services in Connection with Cybersecurity Incident (December 2024)
- Help Net Security: Citrix Bleed: Mass exploitation in progress (CVE-2023-4966) (30 October 2023)
