CVE-2024-6235
published 2024-07-10CVE-2024-6235: Sensitive information disclosure in NetScaler Console
PriorityP181high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
21.33%
97.3th percentile
Sensitive information disclosure in NetScaler Console
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| citrix | netscaler_agent | — | — |
| citrix | netscaler_console | — | — |
| citrix | netscaler_console | >= 14.1-4.42 < 14.1-25.53 | 14.1-25.53 |
| citrix | netscaler_sdx | — | — |
| citrix | netscaler_svm | — | — |
| citrix | xenserver | — | — |
| netscaler | netscaler_console | >= 14.1 < 25.53 | 25.53 |
Detection & IOCsextracted from sources · hover to see the quote
url/internal/v2/config/mps_secret/ADM_SESSIONID
url/nitro/v1/config/mpsuser
cookielogged_in_user_name=nsroot; SESSID=##[a-fA-F0-9]{60}
snort
alert http1 any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Citrix nsroot ADM_SESSIONID Information Disclosure (CVE-2024-6235)"; flow:established,to_server; xbits:set,ET.CVE-202-6235,track ip_pair,expire 120; http.method; content:"GET"; http.uri; bsize:44; content:"/internal/v2/config/mps_secret/ADM_SESSIONID"; fast_pattern; http.header; content:"Tenant-Name|3a 20|Owner"; content:"User-Name|3a 20|nsroot"; content:"Mps-Internal-Request|3a 20|true"; http.header_names; content:!"|0d 0a|Cookie|0d 0a|"; content:!"|0d 0a|Authorization|0d 0a|"; reference:cve,2024-6235; reference:url,attackerkb.com/topics/7zebEgmGLs/cve-2024-6235; classtype:attempted-admin; sid:2061842; rev:1;)
snort
alert http1 any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Citrix CVE-2024-6235 Post-Exploitation Activity (Admin Account Creation)"; flow:established,to_server; xbits:isset,ET.CVE-2024-6235,track ip_dst; http.method; content:"POST"; http.uri; bsize:24; content:"/nitro/v1/config/mpsuser"; fast_pattern; http.header; content:"NITRO_WEB_APPLICATION|3a 20|true"; content:"rand_key|3a 20|"; pcre:"/^[a-fA-F0-9]{32}/R"; http.cookie; content:"logged_in_user_name|3d|nsroot|3b|"; content:"SESSID|3d 23 23|"; pcre:"/^[a-fA-F0-9]{60}/R"; http.request_body; content:"object|3d|"; content:"mpsuser"; content:"name"; distance:0; content:"groups"; content:"owner"; distance:0; reference:url,attackerkb.com/topics/7zebEgmGLs/cve-2024-6235; reference:cve,2024-6235; classtype:trojan-activity; sid:2061845; rev:1;)- →Exploit request uses unauthenticated GET to /internal/v2/config/mps_secret/ADM_SESSIONID with spoofed internal headers: Tenant-Name: Owner, User-Name: nsroot, Mps-Internal-Request: true — and notably lacks Cookie and Authorization headers.
- →Successful exploitation response body contains both '"mps_secret":' and 'ADM_SESSIONID' — match both strings in HTTP response body to confirm disclosure.
- →Post-exploitation admin account creation is indicated by a POST to /nitro/v1/config/mpsuser with header NITRO_WEB_APPLICATION: true, a rand_key header value matching [a-fA-F0-9]{32}, and request body containing 'mpsuser', 'name', 'groups', and 'owner'.
- →Shodan query 'title:"NetScaler Gateway"' can be used to identify exposed NetScaler Console instances potentially vulnerable to this CVE.
- →The Nuclei template extracts the leaked session key via JSON path '.mps_secret[0].key_value' from the disclosure response.
- ·The Snort rule for the initial disclosure (sid:2061842) contains a typo in the xbits tag: 'ET.CVE-202-6235' (missing a '4') instead of 'ET.CVE-2024-6235'. This may cause the xbits correlation with the post-exploitation rule (sid:2061845, which correctly uses 'ET.CVE-2024-6235') to fail.
- ·The Nuclei template sets max-request: 1 and targets the /internal/v2/config/mps_secret/ADM_SESSIONID endpoint; the Referer header must be set to {{RootURL}}/admin_ui/mas/ent/html/main.html for the request to be valid.
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.4CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g3gr-qpxc-qc6c: Sensitive information disclosure in NetScaler Console
ghsa_unreviewed·2024-07-10
CVE-2024-6235 [CRITICAL] CWE-287 GHSA-g3gr-qpxc-qc6c: Sensitive information disclosure in NetScaler Console
Sensitive information disclosure in NetScaler Console
VulnCheck
Citrix NetScaler ADC and NetScaler Gateway Improper Authentication
vulncheck·2024·CVSS 9.4
CVE-2024-6235 [CRITICAL] Citrix NetScaler ADC and NetScaler Gateway Improper Authentication
Citrix NetScaler ADC and NetScaler Gateway Improper Authentication
Sensitive information disclosure in NetScaler Console
Affected: Citrix NetScaler ADC and NetScaler Gateway
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2024-6235&date=2025-10-17; https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2024-6235&date=2025-10-18; https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2024-6235&date=2025-10-19; https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2024-6235&date=2025-10-20; https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2024-6235&date=2025-10-
Citrix
NetScaler Console, Agent and SDX (SVM) Security Bulletin for CVE-2024-6235 and CVE-2024-6236
vendor_citrix·2024-07-10·CVSS 9.4
CVE-2024-6235 [CRITICAL] CWE-119 NetScaler Console, Agent and SDX (SVM) Security Bulletin for CVE-2024-6235 and CVE-2024-6236
NetScaler Console, Agent and SDX (SVM) Security Bulletin for CVE-2024-6235 and CVE-2024-6236
of Problem Two vulnerabilities have been discovered in NetScaler Console (formerly NetScaler ADM), NetScaler SDX (SVM), and NetScaler Agent. Refer to below for further details:
CVE References: CVE-2024-6235, CVE-2024-6236
Affected Products: NetScaler Agent, NetScaler Console, NetScaler SDX, NetScaler SVM, XenServer
Severity: Critical
CVSS Score: 9.4
Remediation:
Cloud Software Group strongly urges customers of NetScaler Console to install the relevant updated versions of NetScaler Console as soon as possible: NetScaler Console 14.1-25.53 and later releases of 14.1 NetScaler Console 13.1-53.22 and later releases of 13.1 NetScaler Console 13.0-92.31 and later releases of 13.0 NetScaler SDX (SVM) 1
Suricata
ET WEB_SPECIFIC_APPS Citrix CVE-2024-6235 Post-Exploitation Activity (Admin Account Creation)
suricata·2025-04-24·CVSS 9.4
CVE-2024-6235 [CRITICAL] ET WEB_SPECIFIC_APPS Citrix CVE-2024-6235 Post-Exploitation Activity (Admin Account Creation)
ET WEB_SPECIFIC_APPS Citrix CVE-2024-6235 Post-Exploitation Activity (Admin Account Creation)
Rule: alert http1 any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Citrix CVE-2024-6235 Post-Exploitation Activity (Admin Account Creation)"; flow:established,to_server; xbits:isset,ET.CVE-2024-6235,track ip_dst; http.method; content:"POST"; http.uri; bsize:24; content:"/nitro/v1/config/mpsuser"; fast_pattern; http.header; content:"NITRO_WEB_APPLICATION|3a 20|true"; content:"rand_key|3a 20|"; pcre:"/^[a-fA-F0-9]{32}/R"; http.cookie; content:"logged_in_user_name|3d|nsroot|3b|"; content:"SESSID|3d 23 23|"; pcre:"/^[a-fA-F0-9]{60}/R"; http.request_body; content:"object|3d|"; content:"mpsuser"; content:"name"; distance:0; content:"groups"; content:"owner"; distance:0; reference:url,attackerkb.com/
Suricata
ET WEB_SPECIFIC_APPS Citrix nsroot ADM_SESSIONID Information Disclosure (CVE-2024-6235)
suricata·2025-04-24·CVSS 9.4
CVE-2024-6235 [CRITICAL] ET WEB_SPECIFIC_APPS Citrix nsroot ADM_SESSIONID Information Disclosure (CVE-2024-6235)
ET WEB_SPECIFIC_APPS Citrix nsroot ADM_SESSIONID Information Disclosure (CVE-2024-6235)
Rule: alert http1 any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Citrix nsroot ADM_SESSIONID Information Disclosure (CVE-2024-6235)"; flow:established,to_server; xbits:set,ET.CVE-202-6235,track ip_pair,expire 120; http.method; content:"GET"; http.uri; bsize:44; content:"/internal/v2/config/mps_secret/ADM_SESSIONID"; fast_pattern; http.header; content:"Tenant-Name|3a 20|Owner"; content:"User-Name|3a 20|nsroot"; content:"Mps-Internal-Request|3a 20|true"; http.header_names; content:!"|0d 0a|Cookie|0d 0a|"; content:!"|0d 0a|Authorization|0d 0a|"; reference:cve,2024-6235; reference:url,attackerkb.com/topics/7zebEgmGLs/cve-2024-6235; classtype:attempted-admin; sid:2061842; rev:1; metadata:affected_produ
Nuclei
NetScaler Console - Sensitive Information Disclosure
nuclei·CVSS 9.4
CVE-2024-6235 [CRITICAL] NetScaler Console - Sensitive Information Disclosure
NetScaler Console - Sensitive Information Disclosure
Sensitive information disclosure in NetScaler Console
Template:
id: CVE-2024-6235
info:
name: NetScaler Console - Sensitive Information Disclosure
author: DhiyaneshDk
severity: critical
description: |
Sensitive information disclosure in NetScaler Console
impact: |
Attackers can access sensitive information including session secrets and administrative credentials from the NetScaler Console without proper authentication.
remediation: |
Apply the patches specified in Citrix advisory CTX677998 to address the information disclosure vulnerability in NetScaler Console.
reference:
- https://support.citrix.com/article/CTX677998
- https://attackerkb.com/topics/7zebEgmGLs/cve-2024-6235
- https://nvd.nist.gov/vuln/detail/cve-2024-6235
classifica
No writeups or analysis indexed.
2024-07-10
Published
Exploited in the wild