PUBLIC EXPLOITS RELEASED FOR CITRIX BLEED 2 NETSCALER FLAW, PATCH NOW

Summary from the TLDR InfoSec newsletter

Researchers have released proof-of-concept (PoC) exploits for the critical CitrixBleed2 vulnerability in Citrix NetScaler that can be used to steal user session tokens. The vulnerability is caused by the use of the sprints function along with a format string containing the “%.*s” format string. Citrix denies active exploitation, but security researcher Kevin Beaumont and ReliaQuest argue that they have seen evidence of exploitation.