Smaller leak however nonetheless harmful
Although watchTowr was solely capable of leak bytes of knowledge utilizing this flaw, in comparison with kilobytes with earlier CitrixBleed points, the uncovered info might nonetheless be helpful to attackers.
Whereas the proof-of-concept didn’t reveal credentials or tokens, it’s potential that repeated requests would finally be capable of leak one thing delicate. On the very least, the leaks can expose course of reminiscence pointers that might enable attackers to extra simply ship payloads utilizing reminiscence write vulnerabilities equivalent to buffer overflows.
By overwriting knowledge in a reminiscence location that usually comprises code the method executes, attackers might bypass anti-exploitation defenses like ASLR to take full management of the system.
