CVE-2022-27503: Citrix StoreFront Security Bulletin for CVE-2022-27503

CTX377814

{{tooltipText}}

Security Bulletin | Medium | {{likeCount}} found this helpful | Created: {{articleFormattedCreatedDate}} | Modified: {{articleFormattedModifiedDate}}

Description of Problem

A reflected cross-site scripting (XSS) issue has been discovered in Citrix StoreFront when it is configured to use SAML authentication. If exploited, this issue would allow an attacker to execute client-side JavaScript in the same context as a legitimate user. This issue has the following identifier:

CVE-ID

Description

Type

Pre-requisites

CVE-2022-27503

Reflected Cross Site Scripting (XSS)

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

A victim user must have a current session on a StoreFront that has been configured to use SAML authentication

The issue affects the following supported versions of Citrix StoreFront:

• Citrix StoreFront 1912 LTSR up to and including CU4 (1912.0.4000)
• Citrix StoreFront 3.12 for 7.15 LTSR up to and including CU8 (3.12.8000)

Affected versions of Citrix Storefront are included within the following supported versions of Citrix Virtual Apps and Desktops:

• Current Release (CR) versions of Citrix Virtual Apps and Desktops up to and including 2112
• Citrix Virtual Apps and Desktops 1912 LTSR up to and including CU4
• Citrix XenApp & XenDesktop 7.15 LTSR up to and including CU8

Mitigating Factors

This issue only exists when Citrix StoreFront is configured to use SAML authentication. StoreFront deployments that have not been configured to use SAML authentication are unaffected.

What Customers Should Do

Citrix recommends that affected customers upgrade to a fixed version as their patching schedule allows.

The issue has been addressed in the following supported Citrix StoreFront versions:

• Citrix StoreFront 2203 LTSR (2203.0.0) and later versions
• Citrix StoreFront 1912 LTSR CU5 (1912.0.5000) and later cumulative updates for 1912 LTSR

The latest versions of Citrix StoreFront can be downloaded from the following location:
https://www.citrix.com/downloads/storefront/

These versions of Citrix StoreFront are included within the following supported versions of Citrix Virtual Apps and Desktops:

• Citrix Virtual Apps and Desktops 2203 LTSR and later versions
• Citrix Virtual Apps and Desktops 1912 LTSR CU5 and later cumulative updates for 1912 LTSR

The latest versions of Citrix Virtual Apps and Desktops can be downloaded from the following location:
https://www.citrix.com/downloads/citrix-virtual-apps-and-desktops/

A hotfix has been released to address this issue for Citrix StoreFront 3.12 for 7.15 LTSR.

The hotfix for Citrix StoreFront 3.12 for 7.15 LTSR is available at the following location:
https://support.citrix.com/article/CTX446966

Acknowledgements

Citrix would like to thank Michał Brzezicki and Paweł Żurek for working with us to protect Citrix customers.

What Citrix is Doing

Citrix is notifying customers and channel partners about this potential security issue through the publication of this security bulletin on the Citrix Knowledge Center at https://support.citrix.com/securitybulletins.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at https://www.citrix.com/support/open-a-support-case.

Subscribe to Receive Alerts

Citrix strongly recommends that all customers subscribe to receive alerts when a Citrix security bulletin is created or modified at https://support.citrix.com/user/alerts.

Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For details on our vulnerability response process and guidance on how to report security-related issues to Citrix, please see the following webpage: https://www.citrix.com/about/trust-center/vulnerability-process.html.

Disclaimer

This document is provided on an “as is” basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. Citrix reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document directly from the Citrix Knowledge Center.

Changelog

Date

Change

2022-04-12

Initial Publication