Citrix Gateway & Cloud MFA - Insufficient Session Validation Vulnerability

The vulnerability lab research team was able to discover a simple but effective insufficient session validation vulnerability that can be exploited to bypass the mfa login authentication process on Citrix ADC/NetScaler v13.0 & v13.1, Citrix Gateway/NetScaler Gateway v13.0 & v13.1 and the Citrix Cloud Services Website. The security vulnerability allows remote attackers to bypass the mfa function by hijacking the session data of an active user (non expired session) to followup with further compromising attacks.

Responsible Disclosure Program (VDPBW) 2021

One year has now passed since the Bundeswehr made public the first vulnerability disclosure policy (vdpbw) for a responsible disclosure program. Since our security researchers always like to be the first to test and actively participate in a bug bounty or responsible disclosure program, we naturally started this time as well.

Many security researchers from all over germany and even the eu participated in the program. Approximately 100 valid security vulnerabilities were submitted. The bundeswehr is already talking about a great success of the "VDPBW" program. One security researcher from the vulnerability-lab team, whom we all know particularly well as the usual suspect "Benjamin Mejri (Kunz)", has once again hit the bell of success.