No Crash Required Verifying the Citrix NetScaler SAML Patch ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://bishopfox.com/blog/no-crash-required-verifying-the-citrix-netscaler-saml-patch-for-cve-2026-8452
• Blog Title: No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > Citrix NetScaler ADC/Gateway (SAML attacks and CVE-2026-8452 patch verification)

🎯 Content Summary

CVE-2026-8452 is a pre-authentication heap overflow in the SAML XML-signature canonicalization code of Citrix NetScaler ADC and NetScaler Gateway. It has a CVSS score of 8.8 and is reachable on Gateway or AAA virtual servers where a SAML policy is configured and attached. A remote attacker can trigger the vulnerable code with a single HTTP POST without credentials, an authenticated session, a pending login request, or a valid XML signature. Corrupting the Net...

🔧 Technical Details

Pre-authentication attack through XML-signature preprocessing: Cryptographic verification does not necessarily protect the code that prepares data for verification. XML signatures require canonicalization before signature validation, so attacker-controlled fields inside an invalid signature can reach XML parsing and memory-copy routines without authentication. In this case, an oversized ec:InclusiveNamespaces PrefixList inside ds:SignedInfo is copied into a fixed-size heap buffer. Structurally signed AuthnRequest, SAMLResponse, and LogoutRequest messages can reach the vulnerable path even when the signature itself is invalid.

Attacker-controlled heap overflow with build-specific exploitation: When overflow bytes come directly from a text attribute, the attacker controls the amount and contents of the overwrite. However, useful pointers and heap layout vary between firmware b...

🤖 Agent Actions

Updated src/pentesting-web/saml-attacks/README.md with:

• Pre-verification XML canonicalization attack surface.
• NetScaler per-VIP SAML reachability.
• Safe 575-byte/35-byte patch-state oracle and control logic.
• Bishop Fox detector commands and safety warning.
• SAML configuration inventory commands.
• nsppe crash, core dump, log, and webshell triage.
• Numbered references to watchTowr, Bishop Fox, and the detector repository.

Validation: git diff --check passed. mdbook was unavailable.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://bishopfox.com/blog/no-crash-required-verifying-the-citrix-netscaler-saml-patch-for-cve-2026-8452

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > Citrix NetScaler ADC/Gateway (SAML attacks and CVE-2026-8452 patch verification)".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0