CVE-2023-4966 Citrix ADC Sensitive Information Disclosure Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•30

Detects exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' with an unusually long 'cs-host' header string, which is characteristic of the exploit.