Please, We Beg, Just One Weekend Free of Appliances Citrix N...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2
• Blog Title: Please, We Beg, Just One Weekend Free of Appliances: Citrix NetScaler CVE-2026-3055 Memory Overread, Part 2
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web > Citrix NetScaler/ADC Security (new page or subsection: CVE-2026-3055 WS-Federation valueless-parameter memory overread)

🎯 Content Summary

Overview and scope: watchTowr concludes that CVE-2026-3055 was assigned to at least two distinct remotely exploitable memory-overread vulnerabilities in Citrix NetScaler, affecting /saml/login and /wsfed/passive?wctx. This second analysis covers the WS-Federation endpoint. Exploitation requires a NetScaler appliance configured as a SAML Identity Provider (IdP), but the attack itself is remote and unauthenticated. The...

🔧 Technical Details

Valueless query-parameter overread: native request handlers may distinguish between a parameter being present and that parameter having valid associated data. If code checks only for the parameter name and later dereferences its expected value buffer, sending ?parameter without = can make the program serialize stale memory. In this case, GET /wsfed/passive?wctx reaches the vulnerable state, and NetScaler places the resulting memory in the Base64-encoded NSC_TASS response cookie.

Dynamic memory sampling: a single overread may not immediately expose useful information because the disclosed allocation depends on current process activity. Repeating an identical request samples different regions over time. Decode every response and search for structured markers such as Cookie, authorization headers, session names, credentials, internal IP addresses, request lines, or product-spec...

🤖 Agent Actions

Plan:

1. Inspect the repository and at least five relevant web/NetScaler pages.
2. Check for existing coverage and choose one non-duplicative target file.
3. Verify the supplied research against primary Citrix material if available.
4. Edit the selected page with concise technical reproduction, impact, and detection guidance.
5. Validate citations, formatting, diff, and repository status.
   Repository search shows no dedicated NetScaler page. Existing NetScaler memory-disclosure and SAML material is concentrated in src/pentesting-web/saml-attacks/README.md, so I’m comparing that page with adjacent web, request-smuggling, cookie, and binary-overread coverage before selecting the edit target.
   The comparison supports updating the existing SAML attacks page rather than creating a product/CVE page: it already documents NetScaler IdP reachability, NSC_TASS as a reflected memory sink, and dynamic overread testing. The new, non-duplicate primitive is the strict distinction between ?wctx and ?wctx= in the WS-Federation handler, plus repeated cookie sampling and response-differential validation. I’ll now verify the vendor scope and original proof-of-concept sources.
   The source check confirms watchTowr is the original technical research, while Citrix’s bulletin independently confirms the CWE-125 classification, SAML-IdP prerequisite, configuration inventory string, and fixed-build guidance. I’m adding a single concise section to the existing SAML page and appending those two sources as references [19] and [20].
   The edit is in place. I’m validating the rendered structure, reference numbering/uniqueness, code syntax, forbidden-source exclusion, and ensuring only the intended file changed.
   Updated src/pentesting-web/saml-attacks/README.md with:

• Generalized valueless query-parameter overread technique.
• NetScaler /wsfed/passive?wctx request example.
• NSC_TASS decoding and dynamic memory-sampling script.
• Session disclosure impact and detection indicators.
• SAML IdP inventory commands and remediation guidance.
• Numbered references to watchTowr’s research and Citrix’s bulletin.

Validation passed:

• git diff --check
• Reference numbering and URL uniqueness
• Forbidden-source exclusion
• Python syntax compilation

mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web > Citrix NetScaler/ADC Security (new page or subsection: CVE-2026-3055 WS-Federation valueless-parameter memory overread)".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0