rascyber

GitHub · Repository owner · Source ID 1847515
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

rascyber/Sternsleuth-Citrix-NetScaler-RXSS

Repository PoC0Created 2026-01-18ScannerCVE-2025-1210110 files

13.6 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based scanner for CVE-2025-12101 that sends a crafted HTTP POST request to /cgi/logout and checks if a known XSS payload is reflected in the response, reporting vulnerable targets without exploiting the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python scanner for CVE-2025-12101 (Citrix NetScaler RXSS). All reviewed source files implement only the advertised scanning functionality: sending a crafted HTTP POST request and checking for reflection of a known XSS payload. No backdoor, concealed executable behavior, or operator-directed harm is observed.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareCitrix NetScaler ADCCitrix NetScaler Gateway
Attack typesCross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a scanner because it sends a probe to detect reflection of a known XSS payload and reports vulnerability status without performing any action that exploits the vulnerability (e.g., no session hijacking, cookie theft, or payload execution in a victim's browser). The README explicitly describes it as a 'scanner' and 'RXSS reflection check'.

README.md:3src/cve_2025_12101_scanner/scanner.py:156-157

Requirements

  • Target must be a NetScaler ADC or Gateway configured as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.README.md:3
  • Target must be reachable over HTTPS (default port 443) or HTTP (port 80).src/cve_2025_12101_scanner/utils.py:30-43

Observed behavior

  • Sends a raw HTTP POST request to /cgi/logout with a hardcoded SAMLResponse and RelayState body containing the payload <script>alert(1)</script>.src/cve_2025_12101_scanner/scanner.py:20-27src/cve_2025_12101_scanner/scanner.py:65
  • Checks if the response contains the string <script>alert(1)</script> and if the HTTP status code is 200 or 302, marking the target as vulnerable.src/cve_2025_12101_scanner/scanner.py:156-157
  • Outputs results to console, optionally to a text file of vulnerable targets, and optionally to a JSON file.src/cve_2025_12101_scanner/cli.py:94-104
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Payload
Payload withheldThe scanner sends a fixed POST body to /cgi/logout to test for XSS reflection, consistent with the stated CVE-2025-12101 vulnerability.src/cve_2025_12101_scanner/scanner.py:20-27
Network Connection
Payload withheldThe scanner connects to the target host and port specified by the user, sends the hardcoded payload, and checks the response. This is the core of the advertised scanning behavior.src/cve_2025_12101_scanner/scanner.py:65-70src/cve_2025_12101_scanner/scanner.py:110-112src/cve_2025_12101_scanner/scanner.py:131-133
Review boundaries

What the analysis did not establish

  • Only 5 of 10 text files in the repository are included; the remaining 5 files (e.g., pyproject.toml, setup.cfg) are omitted from the evidence.
  • The evidence does not include any binary files, but the packet reports 5 unclassified files totaling 2422 bytes that are not analyzed.
  • The scanner's detection logic relies solely on string matching of a specific payload in the response; false positives or negatives may occur if the server reflects the payload in a non-executable context or encodes it differently.
  • Five additional files (unclassified, 2422 bytes) were present in the repository but not included in the text review; their content is unknown.
  • The review does not verify that the scanner correctly identifies the vulnerability or that it is safe to run against production systems.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.