CVE-2023-24485: Citrix Workspace app for Windows Security Bulletin for CVE-2023-24484 & CVE-2023-24485

CTX477617

{{tooltipText}}

Security Bulletin | High | {{likeCount}} found this helpful | Created: {{articleFormattedCreatedDate}} | Modified: {{articleFormattedModifiedDate}}

Description of Problem

Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app.

These vulnerabilities have the following identifiers:

CVE ID

Description

Vulnerability Type

Pre-conditions

CVE-2023-24484

A malicious user can cause log files to be written to a directory that they do not have permission to write to.

CWE-284: Improper Access Control

Local user access to a system where a vulnerable version of Citrix Workspace App for Windows is later installed or uninstalled by a SYSTEM process (e.g. SCCM).

CVE-2023-24485

Privilege Escalation on the system running a vulnerable version of Citrix Workspace app for Windows

CWE-284: Improper Access Control

Local user access to a system at the time a vulnerable version of Citrix Workspace App for Windows is being installed or uninstalled by an Administrator or SYSTEM process (e.g. SCCM).

The vulnerability affects the following supported versions of Citrix Workspace App for Windows:

• Citrix Workspace App versions before 2212
• Citrix Workspace App 2203 LTSR before CU2
• Citrix Workspace App 1912 LTSR before CU7 Hotfix 2 (19.12.7002)

Mitigating Factors

Customers who use the automatic update feature of Citrix Workspace app for Windows will automatically receive updates and may therefore already be protected against these issues.

Additionally, these vulnerabilities are only exposed by a Windows Administrator or SYSTEM process (e.g. SCCM) performing the installation or uninstallation of a vulnerable version of Citrix Workspace App. Customers will only be affected by these vulnerabilities if they perform these actions using a vulnerable version of Citrix Workspace app for Windows.

What Customers Should Do

The issue has been addressed in the following versions of Citrix Workspace app for Windows:

• Citrix Workspace App 2212 and later
• Citrix Workspace App 2203 LTSR CU2 and later cumulative updates
• Citrix Workspace App 1912 LTSR CU7 Hotfix 2 (19.12.7002) and later cumulative updates

Citrix strongly recommends that customers upgrade to a fixed version as soon as possible.

The latest version of Citrix Workspace app for Windows is available from the following Citrix website location:

https://www.citrix.com/downloads/workspace-app/windows/

The latest LTSR version of Citrix Workspace app for Windows is available from the following Citrix website location:

https://www.citrix.com/downloads/workspace-app/workspace-app-for-windows-long-term-service-release/

Citrix Workspace App 1912 LTSR before CU7 Hotfix 2 (19.12.7002) is available from the following Citrix website location:

https://support.citrix.com/article/CTX473064/hotfix-citrix-workspace-app-for-windows-1912-ltsr-cu7-hotfix-2-19127002-english

Acknowledgements

Citrix would like to thank the Lockheed Martin Red Team for working with us to protect Citrix customers.

What Citrix is Doing

Citrix is notifying customers and channel partners about this potential security issue through the publication of this security bulletin on the Citrix Knowledge Center at https://support.citrix.com/securitybulletins.

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at https://www.citrix.com/support/open-a-support-case.

Subscribe to Receive Alerts

Citrix strongly recommends that all customers subscribe to receive alerts when a Citrix security bulletin is created or modified at https://support.citrix.com/user/alerts.

Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For details on our vulnerability response process and guidance on how to report security-related issues to Citrix, please see the following webpage: https://www.citrix.com/about/trust-center/vulnerability-process.html.

Disclaimer

This document is provided on an “as is” basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. Citrix reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document directly from the Citrix Knowledge Center.

Changelog

Date

Change

2023-02-14

Initial publication