CVE-2023-24488

published 2023-07-10

CVE-2023-24488: Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting

Priority P2 79 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

ITW EXPLOIT VulnCheck KEV

Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting

Affected

16 ranges

Vendor	Product	Version range	Fixed in
citrix	application_delivery_controller	>= 12.1 < 12.1-55.296	12.1-55.296
citrix	application_delivery_controller	>= 12.1 < 12.1-65.35	12.1-65.35
citrix	application_delivery_controller	>= 13.0 < 13.0-90.11	13.0-90.11
citrix	application_delivery_controller	>= 13.1 < 13.1-45.61	13.1-45.61
citrix	citrix_adc	—	—
citrix	citrix_adc_and_citrix_gateway	>= 12.1 < 12.1-65.35	12.1-65.35
citrix	citrix_adc_and_citrix_gateway	>= 12.1-FIPS < 12.1-55.296	12.1-55.296
citrix	citrix_adc_and_citrix_gateway	>= 12.1-NDcPP < 12.1-55.296	12.1-55.296
citrix	citrix_adc_and_citrix_gateway	>= 13.0 < 13.0-90.11	13.0-90.11
citrix	citrix_adc_and_citrix_gateway	>= 13.1 < 13.1-45.61	13.1-45.61
citrix	citrix_adc_and_citrix_gateway	>= 13.1-FIPS < 13.1-37.150	13.1-37.150
citrix	citrix_gateway	—	—
citrix	gateway	>= 12.1 < 12.1-65.35	12.1-65.35
citrix	gateway	>= 13.0 < 13.0-90.11	13.0-90.11
citrix	gateway	>= 13.1 < 13.1-45.61	13.1-45.61
citrix	xenserver	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /oauth/idp/logout?post_logout_redirect_uri=%0D%0A%0D%0A%3Cbody+x=%27&%27onload=%22(alert)(%27citrix+akamai+bypass%27)%22%3E

url /oauth/idp/logout?post_logout_redirect_uri=%0d%0a%0d%0aalert(document.domain)

path /oauth/idp/logout

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/oauth/idp/logout?post_logout_redirect_uri|3d|"; fast_pattern; startswith; reference:url,blog.assetnote.io/2023/06/29/binary-reversing-citrix-xss/; reference:url,support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202324487-cve202324488; reference:cve,2023-24488; classtype:web-application-attack; sid:2046719; rev:1; metadata:affected_product Citrix, attack_target Client_Endpoint, created_at 2023_07_03, cve CVE_2023_24488, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence Low, signature_severity Major, tag XSS, tag Open_Redirect, updated_at 2023_07_03; target:src_ip;)

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/oauth/idp/logout?post_logout_redirect_uri|3d 0d 0a 0d 0a|"; fast_pattern; startswith; reference:url,blog.assetnote.io/2023/06/29/binary-reversing-citrix-xss/; reference:url,support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202324487-cve202324488; reference:cve,2023-24488; classtype:web-application-attack; sid:2046720; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_07_03, cve CVE_2023_24488, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence Low, signature_severity Major, updated_at 2023_07_03; target:src_ip;)

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Possible Citrix Gateway CVE-2023-24488 Exploit Attempt M3"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/oauth/idp/logout?post_logout_redirect_uri|3d|ws|3a 2f 2f|localhost/"; fast_pattern; startswith; content:"|0d 0a 0d 0a|"; reference:url,blog.assetnote.io/2023/06/29/binary-reversing-citrix-xss/; reference:url,support.citrix.com/article/CTX477714/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202324487-cve202324488; reference:cve,2023-24488; classtype:web-application-attack; sid:2046721; rev:1; metadata:affected_product Citrix, attack_target Client_Endpoint, created_at 2023_07_03, cve CVE_2023_24488, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence Low, signature_severity Major, tag XSS, updated_at 2023_07_03; target:src_ip;)

• → Exploit targets the /oauth/idp/logout endpoint via GET request with a crafted post_logout_redirect_uri parameter containing CRLF injection sequences (%0D%0A or |0d 0a|) to inject HTML/script content into the HTTP response body.
• → Successful exploit probe returns HTTP 302 redirect with reflected XSS payload (alert(document.domain) or inline script) in the response body with Content-Type: text/html.
• → Appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server for the vulnerability to be exploitable. ↗
• → M3 variant uses a WebSocket-style URI (ws://localhost/) in the post_logout_redirect_uri parameter followed by a double CRLF sequence as an alternative bypass technique.
• → Shodan/FOFA/Google dork for exposed Citrix Gateway instances: search for title 'Citrix Gateway'.

• · Vulnerability is only exploitable when the Citrix ADC/Gateway appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) OR as an AAA virtual server. Appliances not in these roles are not affected. ↗

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vulncheck 6.1 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79 CWE-253