# No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452

Heap overflow in NetScaler SAML canonicalization copies attacker PrefixList into fixed buffer pre-auth, enabling memory corruption and potential RCE via one HTTP request.

- Payout: Research
- Severity: high
- Program: Citrix
- Write-up by: Michael Tucker
- Disclosed: 2026-08-21
- CVE: CVE-2026-8452
- Write-up quality: 7/10
- Original: https://bishopfox.com/blog/no-crash-required-verifying-the-citrix-netscaler-saml-patch-for-cve-2026-8452
- Library page: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-no-crash-required-verifying-the-citrix-netscaler-saml-patch-for-cve-2026-8452
- Tags: area:devices domain:network impact:dos impact:rce kind:research platform:research sev:high tech:saml technique:reverse-engineering technique:source-review vuln:dos vuln:memory-corruption vuln:rce

**Target:** NetScaler ADC/Gateway SAML endpoints (/saml/login, /cgi/samlauth)
**Root cause:** During exclusive canonicalization the PrefixList attribute from ds:CanonicalizationMethod/ec:InclusiveNamespaces is copied into a fixed-size buffer without a length check, before signature verification, so attacker-controlled bytes overflow the heap.
**Steps:**
1. Identify NetScaler via Citrix-specific URI schemes in Content-Security-Policy header.
2. POST a signed AuthnRequest with a 575-byte PrefixList (64 prefixes) to `/saml/login` (IdP route).
3. Fallback: POST a SAMLResponse with the same 575-byte PrefixList to `/cgi/samlauth` (SP route).
4. Send a control request with a 35-byte PrefixList; verdict valid only if answers differ.
5. Interpret: 513+ bytes returning `500 Internal Server Error 43549` = vulnerable; `200 Malformed Assertion sent to Netscaler` = patched.
6. For exploitation, send PrefixList >= ~1151 bytes to overflow past the buffer and corrupt memory in nsppe.
**How found:** Defender-side: mapped appliance responses to PrefixList lengths either side of the fix, found an exact 512/513 boundary, then confirmed by diffing the packet engine binary before/after patch (cmp r/m32, 0x201 at 0xa50aa2 new in 13.1-63.18).
**Exploitation:** watchTowr's PoC sends a crafted SAML message whose PrefixList overflows the fixed buffer in the packet engine, overwriting memory with attacker text; hardcoded addresses target 13.1-30.52 and drop a webshell at /var/vpn/theme/x.php. On mismatched builds the corruption still occurs but crashes at an address spelling payload ASCII (0x3834313030304cea).
**Escalation:** Packet engine carries all appliance traffic, so corruption can yield RCE and full session compromise; watchTowr chained to a webshell.
**Insight:** SAML canonicalization must rewrite signed content before verifying the signature, so any parser handling PrefixList/InclusiveNamespaces is pre-auth attack surface; length-oracle probing at the exact fix boundary (512 vs 513) safely fingerprints patch state without crashing.

## Proof of concept (copied exactly from the original report)

**Signed AuthnRequest with 575-byte PrefixList probe**

```
A signed AuthnRequest carrying a 575-byte PrefixList, 64 prefixes, POSTed to /saml/login. That length sits above the 512-byte check, so a patched appliance’s check fires, and well below the roughly 1,151 bytes where an unpatched appliance starts corrupting memory. At 575 bytes we have never seen a core dump, a daemon restart, or a reboot on any appliance we have tested. The request has to be signed, because an unsigned AuthnRequest draws the patched answer from vulnerable and patched builds alike, which would make everything look fixed. This route goes first because it kept giving the right answer when we fed it details a scanner cannot know: a bogus assertion consumer service URL, a bogus issuer, and a timestamp two hours outside the appliance’s tolerance. 
- Fall back to the Service Provider route if the first produced no answer. The same 575-byte PrefixList, this time inside a SAMLResponse POSTed to /cgi/samlauth.
```

**PrefixList XML location in signature**

```
ds:Signature / ds:SignedInfo / ds:CanonicalizationMethod / ec:InclusiveNamespaces @ PrefixList
```

## Write-ups of the same bug (oldest first)
- 2026-08-14: [You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452) — Sina Kheirkhah
- 2026-08-21: [No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452](https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-no-crash-required-verifying-the-citrix-netscaler-saml-patch-for-cve-2026-8452) — Michael Tucker (this one)