Critical NetScaler Admin Takeover Vulnerability
A major vulnerability in the Citrix NetScaler Console, initially classified as a “sensitive information disclosure” issue, has been found to allow complete unauthenticated administrative access.
Proof-of-concept (PoC) exploit code has been released, enabling attackers to exploit an internal API flaw to create administrator accounts without authentication.
Citrix first disclosed CVE-2024-6235 on July 10, 2024, assigning it a CVSSv4 score of 9.4, indicating a critical severity level. Although the initial advisory described the flaw as merely a “sensitive information disclosure” in the NetScaler Console, security researcher chutton-r7 from Rapid7 has revealed that the vulnerability’s true impact is much more severe. It enables unauthenticated attackers to gain full administrative control of affected systems.
Rapid7’s analysis confirms:
“The vulnerability allows an unauthenticated attacker to obtain an admin-level session ID from an internal API and use this to create additional administrator users on the system.”
This escalation effectively turns what was believed to be an information disclosure issue into a full system compromise.
According to Shodan data, around 318 NetScaler Console instances are currently exposed to the internet and potentially vulnerable.
Details of the Exploit
The vulnerability stems from an internal API endpoint that improperly leaks administrative session tokens.
Attackers can trigger the issue by sending a simple GET request to /internal/v2/config/mps_secret/ADM_SESSIONID with specific headers.
The exploit requires three specific HTTP headers to successfully retrieve a valid session token.
Once an attacker acquires the session ID, they must also retrieve a second parameter, known as rand_key, from the NetScaler admin panel’s HTML. With both the session ID and rand_key, an attacker can create a new super administrator account, granting full access to the system.
The proof-of-concept (PoC) script fully automates this process—extracting the session ID from the internal API, obtaining the required rand_key, and then creating a new administrative user.
Risk Factors and Details
| Category | Description |
|---|---|
| Affected Products | NetScaler Console versions 14.1 prior to 14.1-25.53 |
| Impact | Full administrative access through unauthenticated session hijacking |
| Exploit Prerequisites | Network access to the NetScaler Console IP address (no authentication required) |
| CVSS 3.1 Score | 9.4 (Critical) |
Affected Systems and Patch Information
The vulnerability impacts all NetScaler Console versions 14.1 prior to 14.1-25.53.
Earlier versions, including branches 13.1.x and 12.1.x, are reportedly unaffected.
Citrix released patches in July 2024 to address this vulnerability along with several other security issues affecting NetScaler products.
Security experts strongly recommend upgrading immediately to version 14.1-25.53 or later. Additionally, it is advised to avoid exposing NetScaler Console instances directly to the public internet.
Organizations should enforce robust patch management practices and limit access to management interfaces through network segmentation and the use of privileged access workstations.
As of April 24, 2025, researchers continue to monitor for signs of active exploitation, making this vulnerability a serious ongoing risk for any unpatched NetScaler Console deployments.
