[critical] Citrix Bleed: NetScaler session token leak (CVE-2023-4966)

Mon, 18 Dec 2023 00:00:00 GMT

A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users).

Status: closed · Patch: patched · Fixed in: 14.1-8.50, 13.1-49.15, 13.0-92.19, FIPS/NDcPP builds: see vendor advisory

Latest updates:

2023-12-18: Xfinity discloses that Citrix Bleed exploitation on Oct 16–19 exposed data on 35.9M customers (source)
2023-11-21: CISA, FBI, MS-ISAC and ACSC warn that LockBit 3.0 affiliates are exploiting Citrix Bleed (AA23-325A) (source)
2023-10-23: Citrix issues additional mitigation guidance (source)

CVEs: CVE-2023-4966

[high] Okta support system breach: HAR files with session tokens stolen

Wed, 29 Nov 2023 00:00:00 GMT

An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-11-29: Okta: the attacker downloaded the names and email addresses of all customer support system users (source)
2023-11-03: Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked (source)
2023-10-19: Okta notifies customers of the security incident (source)

pwn.watch: Session Hijacking incident updates

[critical] Citrix Bleed: NetScaler session token leak (CVE-2023-4966)

[high] Okta support system breach: HAR files with session tokens stolen