You're Back in the Room Citrix NetScaler Pre-Authentication ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452
• Blog Title: You're Back in the Room: Citrix NetScaler Pre-Authentication RCE via Likely CVE-2026-8452
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > Citrix NetScaler; cross-reference Binary Exploitation > Libc Heap and Write What Where 2 Exec

🎯 Content Summary

Overview and affected configurations

watchTowr Labs reverse-engineered a remotely reachable, pre-authentication heap overflow in Citrix NetScaler ADC and NetScaler Gateway and developed it into root remote code execution. The researchers believe the vulnerability is CVE-2026-8452 because Citrix describes that CVE as a memory-overflow issue, but they cannot conclusively map the analyzed patch to that identifier because Citrix's bulletin does not associate each credited...

🔧 Technical Details

SAML canonicalization overflow: When an SAML or XML-signature implementation canonicalizes attacker-controlled ds:SignedInfo into a fixed-size buffer, inspect variable-length fields accepted by the selected C14N algorithm. Exclusive C14N's ec:InclusiveNamespaces PrefixList can provide a large input even when algorithm names, URIs, and other attributes are constrained. If duplicate prefixes are rejected, generate unique tokens such as N0 N1 ... N1999. Signature parsing or canonicalization may occur before successful authentication, making the memory corruption pre-authentication.

Tracing delayed heap-corruption crashes: A crash inside a copy or packet-processing function may occur long after the original overflow because the corrupted chunk was placed on a freelist and later reused. Trace backward from the fault, set breakpoints at allocator and consumer functions, and inspect trusted structure fields at e...

🤖 Agent Actions

Updated src/binary-exploitation/libc-heap/heap-overflow.md with:

• SAML/XML canonicalization overflow via unique InclusiveNamespaces PrefixList tokens.
• Delayed fixed-stride pool metadata corruption analysis.
• Self-describing overflow markers and length-based heap grooming.
• Trusted memcpy conversion into write-what-where.
• Pointer-arithmetic compensation and callback hijacking.
• Predictable RWX heap execution and watchdog signal-handler neutralization.
• Numbered references to the original watchTowr research and Citrix bulletin.

Validation passed with git diff --check, citation checks, and forbidden-source checks. mdbook was unavailable, so a full build could not be run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > Citrix NetScaler; cross-reference Binary Exploitation > Libc Heap and Write What Where 2 Exec".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0