# CVE-2023-4966: NetScaler - Information Disclosure

> Live exploitation tracking for CVE-2023-4966 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-4966

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.4
- **Public exploit available:** Yes
- **Affected products:** Citrix NetScaler Gateway
- **Weaknesses:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
- **Tags:** sslvpn

## Description

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

## CrowdSec analysis

[CVE-2023-4966](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-4966) is a critical vulnerability in NetScaler ADC and NetScaler Gateway, which can lead to sensitive information disclosure when the system is configured as a gateway or virtual server.

CrowdSec has been tracking this vulnerability and its exploits since 4th of December 2024.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2023-4966 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2023-4966. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Observed exploitation attempts target URLs containing `/oauth/idp/.well-known/openid-configuration`.

## Timeline

- 2023-10-10: CVE Published. CVE-2023-4966 is published to NVD.
- 2023-10-18: CISA KEV. CVE-2023-4966 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2023-11-08: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-12-04: Rule Released. CrowdSec releases a rule to detect CVE-2023-4966 exploitation attempts against the CrowdSec Network.
- 2024-12-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-4966 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4966.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-4966) follows observed exploitation activity for CVE-2023-4966. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.