UPDATE: Citrix Workspace Vulnerability

Release Date: 22-07-2020 14:42:00

UPDATE: Citrix Workspace Vulnerability

History:

22/07/2020 --- v1.0 -- Initial publication
23/09/2020 --- v1.1 -- Updated with information about new attack vector

Summary

Citrix Workspace is vulnerable to a remote command execution attack [1]. The flaw sees Workspace app's automatic update feature abused to gain access to a vulnerable Workspace app installation, with the attack vector being a named pipe [3]. Citrix have assigned CVE-2020-8207 to the vulnerability and released updated versions for Workspace app [2].

Since July, there has been found a secondary attack vector, which would allow attackers to elevate privileges and remotely execute arbitrary commands under the SYSTEM account [6, 7].

Technical Details

By sending a crafted message over a named pipe and spoofing the client process ID, the Citrix Workspace Updater Service can be tricked into executing an arbitrary process under the SYSTEM account. Whilst a low privilege account is required to perform the attack, environments that do not implement SMB signing are particularly vulnerable since an attack can be achieved without knowing valid credentials through NTLM credential relaying [1, 3].

A new attack vector has been discovered [7]. The core of the issue lies with a remote command line injection vulnerability that allows attackers to bypass Citrix signed MSI installers using a malicious MSI transform [6, 7].