""ET EXPLOIT Citrix ADC and NetScaler Gateway Information Disclosure - Successful Response (CVE-2023-4966)""

SID: 2048932

Revision: 1

Class Type: successful-admin

Metadata: attack_target Web_Server, created_at 2023_10_29, cve CVE_2023_4966, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Critical, updated_at 2023_10_29, reviewed_at 2023_10_29

Reference:

  • cve

  • 2023-4966

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_client

Contents:

  • Value: "200"

  • Value: "Content-Type|3a 20|application/json"

  • Value: "|7b 22|issuer|22 3a 20 22|http" Depth: 16

  • Value: !"|22 2c 20 22|authorization_endpoint"

Within: 20000

PCRE:

Special Options:

  • http_stat_code

  • http_header

  • file_data

  • fast_pattern

source