Unit 7: The network from the host · Lesson 7 of 7 · 16 min

Case file: sessions that survive the patch

Patching a gateway does not log out the people already inside. Find sessions that predate the patch.

mission

You are
You are finishing the gw01 response.
Situation
The patch went on at 11:00 on 10 October. The gateway's active session list was exported on 21 October.
Goal
List sessions created before the patch and spot one that should not exist.
Hand in
Sessions to kill and the user whose session was taken over.

case file

Citrix Bleed

Citrix NetScaler ADC/Gateway customers · 2023

CVE-2023-4966 in customer-managed NetScaler ADC and Gateway appliances leaked memory that could include valid session tokens, letting attackers hijack authenticated sessions and potentially bypass MFA. Mandiant found zero-day exploitation dating to at least August 2023, and LockBit 3.0 affiliates later exploited it widely, with reported targets including Boeing, DP World and ICBC. Authenticated sessions persisted after patching, so patching alone did not evict attackers.

What went wrong

A buffer over-read in the gateway exposed session tokens; stolen sessions remained valid after the software update because existing sessions were not invalidated.

What would have stopped it

  • Patch internet-facing gateways urgently and, after patching, terminate all active and persistent sessions so stolen tokens stop working.
  • Bind sessions to client attributes and keep session lifetimes short on remote access gateways.
  • Isolate vulnerable appliances if patching and session termination cannot be done immediately.

What defenders could have seen

  • The same session ID used from different IP addresses or client fingerprints.
  • Remote access sessions that show no corresponding authentication/MFA event.
  • Lateral movement or new remote-tool activity originating from VPN-assigned addresses.

sourcescisa.govdarkreading.comdarkreading.com

Why patching is not enough

  1. Flaw leaks session tokensBefore the patch
  2. Patch appliedNo new leaks
  3. Old tokens still validWhoever copied one is still logged in
  4. Kill all sessionsEveryone signs in again
01

Read the session list

learner@root-lab
head -n 3 active-sessions.csv
session_id,user,created,last_seen,client_ip
d4e1e316,a.khan,2026-10-09T12:00:00Z,2026-10-21T11:42:00Z,10.40.1.197
40f639db,b.osei,2026-10-09T18:00:00Z,2026-10-21T13:25:00Z,10.40.6.101
grep -c . active-sessions.csv
19

you should see A header and 18 sessions.

02

Sessions older than the patch

learner@root-lab
awk -F, 'NR > 1 && $3 < "2026-10-10T11:00:00Z" {print $1, $2, $3}' active-sessions.csv
d4e1e316 a.khan 2026-10-09T12:00:00Z
40f639db b.osei 2026-10-09T18:00:00Z
00a854c6 c.lindqvist 2026-10-08T18:00:00Z
70d82dff d.moreau 2026-10-08T08:00:00Z
4c8e55e0 e.tanaka 2026-10-08T20:00:00Z
442b9204 g.novak 2026-10-10T04:00:00Z
62fd9868 h.ali 2026-10-09T14:00:00Z

you should see Seven sessions were created before the fix and are still alive eleven days later.

03

Look at where they come from

learner@root-lab
awk -F, 'NR > 1 && $5 !~ /^10\./' active-sessions.csv
70d82dff,d.moreau,2026-10-08T08:00:00Z,2026-10-21T17:32:00Z,45.77.12.9

you should see One session sits on an outside address: the same one from the investigation.

defender tip Vendors for these flaws told customers to terminate all active and persistent sessions after updating.

After the update

Patch only
update applied 2026-10-10 11:00
sessions: unchanged

Stolen sessions keep working

Patch and reset
update applied
kill all sessions
force sign-in with MFA
review sessions from new addresses

Every stolen token dies

What a defender takes away

  1. 1A patch closes the hole; it does not evict anyone.
  2. 2Kill sessions and rotate secrets after edge patches.
  3. 3Watch for one session moving to a new address.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.