CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•32

Detects potential exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' that result in a 200 HTTP status code, indicating a successful attempt to access this specific endpoint which is part of the vulnerability exploitation chain.