Citrix ADC (NetScaler) CVE-2026-3055 Scanner

MetasploitMetasploit auxiliary PoCScannerRubyauxiliary_scanner/http/citrix_netscaler_cve_2026_3055

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit auxiliary module scans for CVE-2026-3055, a memory overread vulnerability in Citrix ADC/NetScaler when configured as a SAML IdP. It sends crafted HTTP GET requests to the /wsfed/passive endpoint with a long random Host header and a wctx parameter, then inspects the Set-Cookie header for NSC_TASS cookies containing leaked memory. The module decodes the base64-encoded leaked data and scans it for session cookies (SESSID, NITRO_SK, NSC_AAAC) to report exposure. It does not exploit the vulnerability to gain access or execute code.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a scanner for CVE-2026-3055, a memory overread vulnerability in Citrix NetScaler. The module sends crafted HTTP requests to leak memory and extracts session cookies from the response. No backdoor, deceptive payload, or concealed operator-directed harm was observed. The code performs only the documented vulnerability scanning and reporting functions.

ClassificationScanner
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareCitrix ADCNetScaler Gateway
Attack typesMemory OverreadInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's primary operation is to detect and report the presence of the vulnerability by sending probe requests and analyzing responses for leaked memory and session cookies. It does not contain code to hijack sessions, execute commands, or otherwise exploit the vulnerability for unauthorized access. The module name, description, and behavior all indicate a scanner.

modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:16-20modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:51-87modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:89-208

Requirements

  • Target must be a Citrix ADC/NetScaler configured as a SAML IdP.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:18-19
  • Target must be running a vulnerable version (e.g., ADC 14.1 < 66.59, 13.1 < 62.23).modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:1

Observed behavior

  • Sends HTTP GET requests to /wsfed/passive with a 128-character random Host header and a wctx parameter.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:53-62
  • Checks for vulnerability by verifying the presence of an NSC_TASS cookie in the 302 response; reports Safe if no cookies or no NSC_TASS cookie.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:70-83
  • In run mode, sends up to LEAK_REQUEST_COUNT (default 4096) requests, extracts base64-encoded leaked data from NSC_TASS cookies, and scans for SESSID, NITRO_SK, and NSC_AAAC session cookies.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:98-188
  • Reports vulnerability and leaked cookie details to the user; does not establish a session or execute commands.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:194-208
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Scanner
CVE-2026-3055 memory overread scannerThe module sends GET requests to /wsfed/passive with a long random Host header and a wctx parameter to trigger a memory leak, then parses Set-Cookie headers for leaked session cookies.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:100-109modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:140-187
Credential Extraction
SESSID, NITRO_SK, NSC_AAAC cookiesThe module scans leaked memory for session cookies and reports them. This is the intended purpose of the scanner and not a hidden backdoor.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:160-187
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The module's actual runtime behavior, effectiveness, and safety are not verified.
  • The evidence does not include any binary or compiled components.
  • Only the module source code was reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
  • Binary files were flagged as metadata-only and not inspected, but no binary files were present in this evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1