Security flaws in Citrix Virtual Apps session recording component reported
Take action: If you are using Citrix and Virtual apps, we can only repeat the message from Shadowserver - While there a debate on whether these are remotely exploitable without auth, we urge you to update your Citrix installations NOW!
Learn More
Summary: Security researchers have identified multiple vulnerabilities in Citrix Virtual Apps and Desktop's Session Recording component, which could allow attackers to execute code and escalate privileges under certain conditions.
Citrix classifies these as medium-severity authenticated vulnerabilities, while watchTowr researchers argue they are more severe, describing them as "point-click-full-takeover" and publishing proof-of-concept exploit. The Shadowserver Foundation has detected active exploitation attempts.
The Shadowserver foundation have a simple message: "While there is discussion on whether these are remotely exploitable without auth, we urge you to update your installations NOW"
Vulnerability details:
- CVE-2024-8068 (official CVSS score 5.1) - Allows escalation to NetworkService Account access. Per claims fo Citrix, attacker must be an authenticated user in the same Windows Active Directory domain
- CVE-2024-8069 (CVSS score 5.1) - Remote Code Execution with NetworkService Account privileges. Per claims fo Citrix, attacker must be on the same intranet as the session recording server.
The vulnerabilities stem from the Session Recording component that captures user activity, keyboard/mouse input, and desktop video streams. The issue involves a misconfigured MSMQ (Microsoft Message Queuing) instance with insecure permissions that uses BinaryFormatter for deserialization, which Microsoft has deemed inherently unsafe. The vulnerabilities are accessible via HTTP, making them potentially exploitable remotely.
Affected Versions:
- Citrix Virtual Apps and Desktops versions from 16.0 up to:
- Version 2407 before hotfix 24.5.200.8
- Version 1912 LTSR before CU9 hotfix 19.12.9100.6
- Version 2203 LTSR before CU5 hotfix 22.03.5100.11
- Version 2402 LTSR before CU1 hotfix 24.02.1200.16
- Citrix Virtual Apps and Desktops 2407 hotfix 24.5.200.8 or later
- Citrix Virtual Apps and Desktops 1912 LTSR CU9 hotfix 19.12.9100.6 or later
- Citrix Virtual Apps and Desktops 2203 LTSR CU5 hotfix 22.03.5100.11 or later
- Citrix Virtual Apps and Desktops 2402 LTSR CU1 hotfix 24.02.1200.16 or later
