Description of Problem
Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app.
These vulnerabilities have the following identifiers:
|
CVE ID |
Description |
Vulnerability Type |
Pre-conditions |
|
CVE-2023-24484 |
A malicious user can cause log files to be written to a directory that they do not have permission to write to. |
CWE-284: Improper Access Control |
Local user access to a system where a vulnerable version of Citrix Workspace App for Windows is later installed or uninstalled by a SYSTEM process (e.g. SCCM). |
|
CVE-2023-24485 |
Privilege Escalation on the system running a vulnerable version of Citrix Workspace app for Windows |
CWE-284: Improper Access Control |
Local user access to a system at the time a vulnerable version of Citrix Workspace App for Windows is being installed or uninstalled by an Administrator or SYSTEM process (e.g. SCCM). |
The vulnerability affects the following supported versions of Citrix Workspace App for Windows:
- Citrix Workspace App versions before 2212
- Citrix Workspace App 2203 LTSR before CU2
- Citrix Workspace App 1912 LTSR before CU7 Hotfix 2 (19.12.7002)
Mitigating Factors
Customers who use the automatic update feature of Citrix Workspace app for Windows will automatically receive updates and may therefore already be protected against these issues.
Additionally, these vulnerabilities are only exposed by a Windows Administrator or SYSTEM process (e.g. SCCM) performing the installation or uninstallation of a vulnerable version of Citrix Workspace App. Customers will only be affected by these vulnerabilities if they perform these actions using a vulnerable version of Citrix Workspace app for Windows.
What Customers Should Do
The issue has been addressed in the following versions of Citrix Workspace app for Windows:
- Citrix Workspace App 2212 and later
- Citrix Workspace App 2203 LTSR CU2 and later cumulative updates
- Citrix Workspace App 1912 LTSR CU7 Hotfix 2 (19.12.7002) and later cumulative updates
Citrix strongly recommends that customers upgrade to a fixed version as soon as possible.
The latest version of Citrix Workspace app for Windows is available from the following Citrix website location:
https://www.citrix.com/downloads/workspace-app/windows/
The latest LTSR version of Citrix Workspace app for Windows is available from the following Citrix website location:
https://www.citrix.com/downloads/workspace-app/workspace-app-for-windows-long-term-service-release/
Citrix Workspace App 1912 LTSR before CU7 Hotfix 2 (19.12.7002) is available from the following Citrix website location:
Acknowledgements
What Citrix is Doing
Obtaining Support on This Issue
Subscribe to Receive Alerts
Reporting Security Vulnerabilities to Citrix
Disclaimer
Changelog
| Date | Change |
| 2023-02-14 | Initial publication |