Unit 10: Edge devices and remote access · Lesson 3 of 5 · 18 min

Case file: sessions that survive the patch

The gateway was patched, but a stolen session keeps working from a new address. Find it and learn why the fix includes killing every session.

case file

Citrix Bleed

Citrix NetScaler ADC/Gateway customers · 2023

CVE-2023-4966 in customer-managed NetScaler ADC and Gateway appliances leaked memory that could include valid session tokens, letting attackers hijack authenticated sessions and potentially bypass MFA. Mandiant found zero-day exploitation dating to at least August 2023, and LockBit 3.0 affiliates later exploited it widely, with reported targets including Boeing, DP World and ICBC. Authenticated sessions persisted after patching, so patching alone did not evict attackers.

What went wrong

A buffer over-read in the gateway exposed session tokens; stolen sessions remained valid after the software update because existing sessions were not invalidated.

What would have stopped it

  • Patch internet-facing gateways urgently and, after patching, terminate all active and persistent sessions so stolen tokens stop working.
  • Bind sessions to client attributes and keep session lifetimes short on remote access gateways.
  • Isolate vulnerable appliances if patching and session termination cannot be done immediately.

What defenders could have seen

  • The same session ID used from different IP addresses or client fingerprints.
  • Remote access sessions that show no corresponding authentication/MFA event.
  • Lateral movement or new remote-tool activity originating from VPN-assigned addresses.

sourcescisa.govdarkreading.comdarkreading.com

mission

You are
The analyst checking the remote access gateway after patching.
Situation
gw01 leaked session tokens before the patch. The patch went in on 11 October, but nobody terminated existing sessions. This lab is modelled on Citrix Bleed.
Goal
Find any session used from a new address after the patch without a fresh login.
Hand in
The session ID, the user, the new address and the fix.

A copied wristband

01

Find the patch

Search the log for patch.

you should see Patched at 20:00 on 11 October with sessions_terminated=no.

02

Follow one session

Search for sid=7f3a20. Read the source address on every line.

you should see The session logged in once with MFA from 198.51.100.52, then resumed twice after the patch from 203.0.113.199 with no new login.

defender tip A session token is a password that skips MFA. When tokens may have leaked, end every session and make users sign in again.

03

Check the other sessions

Search for resume and scan the addresses. Every other session stays on its user's usual address.

you should see Only one session moved.

The fix

Patch only
install update
sessions_terminated=no

Stolen tokens keep working after the patch.

Patch and evict
install update
kill all active and persistent sessions
short session lifetimes, bind to client

Every stolen token stops working.

04

Write the eviction plan

List every remote access gateway, kill all active and persistent sessions on each, then watch for any resume without a fresh MFA login.

you should see A short runbook the on-call team can follow during the next emergency patch.

What a defender takes away

  1. 1Patching closes the hole; ending sessions evicts whoever already got in.
  2. 2The same session ID from two addresses is a strong signal.
  3. 3Resumes without a matching MFA login deserve an alert.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.