HTTP Request Smuggling in Citrix NetScaler ADC Gateway

HTTP Request Smuggling (CWE-444) represents a critical vulnerability affecting Citrix NetScaler ADC and Gateway products through inconsistent interpretation of HTTP requests. When multiple HTTP parsers (proxies, load balancers, backend servers) interpret request boundaries differently, attackers can inject malicious requests that bypass security controls, authentication, and WAF protections. This vulnerability is particularly severe because it affects gateway and load-balancing infrastructure—devices trusted to protect internal networks. Organizations running vulnerable versions (ADC before 14.1-73.37 or 13.1-64.23; Gateway before 14.1-73.37 FIPS or 13.1-64.23) face direct exposure to request smuggling attacks that could lead to privilege escalation, session hijacking, or lateral movement within protected networks.

While no specific MITRE ATT&CK techniques are currently mapped to this CVE, Casky's 754 security skills—powered by Claude AI with extended reasoning—would detect HTTP Request Smuggling attack patterns by analyzing proxy behavior anomalies, request header manipulation, and boundary condition detection across network traffic. Practitioners using Casky would observe findings highlighting suspicious request fragmentation, conflicting Content-Length and Transfer-Encoding headers, and discrepancies between how frontend and backend systems parse incoming HTTP traffic. The platform's skill library would flag techniques associated with defense evasion and credential access (T1036, T1110) that typically accompany smuggling attacks, enabling security teams to identify exploitation attempts before attackers establish persistence or move laterally through compromised gateways.