CVE-2024-8069

Deserialization of Untrusted Data (CWE-502)

Published: Nov 12, 2024 / Updated: 7d ago

010
CVSS 5.1EPSS 0.04%Medium
CVE info copied to clipboard

Summary

Limited remote code execution vulnerability in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server. The vulnerability allows an attacker to execute code with the privileges of a NetworkService Account.

Impact

This vulnerability could allow an authenticated attacker on the same intranet to execute arbitrary code with NetworkService Account privileges on the Citrix Session Recording server. This could lead to unauthorized access to sensitive information, potential modification or deletion of data, and possible disruption of service availability. The attacker could potentially use this access as a stepping stone for further lateral movement within the network.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the provided information, there is no mention of an available patch. The security team should monitor Citrix's official channels for patch announcements and apply them as soon as they become available.

Mitigation

1. Implement network segmentation to restrict access to the Citrix Session Recording server from untrusted networks. 2. Enforce strong authentication mechanisms and review user access privileges regularly. 3. Monitor and log activities on the Citrix Session Recording server for any suspicious behavior. 4. Keep the Citrix Session Recording software up to date with the latest security patches when they become available. 5. Consider implementing additional security controls such as intrusion detection/prevention systems (IDS/IPS) to monitor network traffic for potential exploitation attempts.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-8069. See article

Nov 12, 2024 at 2:57 PM / The Hacker News
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 12, 2024 at 6:11 PM
CVE Assignment

NVD published the first details for CVE-2024-8069

Nov 12, 2024 at 6:15 PM
CVSS

A CVSS base score of 5.1 has been assigned.

Nov 12, 2024 at 6:21 PM / nvd
Threat Intelligence Report

CVE-2024-8069 is a critical vulnerability in Citrix Recording Manager that allows for limited remote code execution (RCE) but requires admin-level access for exploitation. The vulnerability is characterized by its ease of exploitation, making it an attractive target for cybercriminals, although specific details about exploitation in the wild or proof-of-concept exploits are not provided. Organizations must act swiftly to mitigate potential risks, as no specific mitigations, detections, or patches are mentioned in the provided information. See article

Nov 12, 2024 at 6:38 PM
CVSS

A CVSS base score of 8.8 has been assigned.

Nov 13, 2024 at 4:41 PM / nvd
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.1%)

Nov 13, 2024 at 4:41 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (210958)

Nov 15, 2024 at 12:15 AM
Exploitation in the Wild

Attacks in the wild have been reported by Vulnerability Archives • Cybersecurity News. See article

Static CVE Timeline Graph

Affected Systems

Citrix
+null more

Attack Patterns

CAPEC-586: Object Injection
+null more

References

Citrix Virtual Apps and Desktop 7 (CVE-2024-8069)
It’s essentially the ‘thin client’ experience that people were very excited about some 30 years ago - instead of having software and files stored on each individual device, the application (or entire desktop) runs on a big meaty server safely tucked away in a datacenter, and is streamed to end-users via the network. /* 3 */ Trace.WriteLine(string.Format("\nBegin Session Recording Storage Manager install @ {0} ...", DateTime.Now));
CVE-2024-8068 and CVE-2024-8069: Citrix Session Recording Vulnerability
IONIX Tracks CVE-2024-8068 and CVE-2024-8069: Citrix Session Recording Vulnerability (claimed to be RCE) : This post is based on ongoing security research – and will continue to be updated as we get additional information… Based on scanning of thousands of Citrix instances in the attack surface of IONIX customers, IONIX research team believes that most of the Citrix instances cannot be attacked remotely (without authentication) with the currently available exploits.
Critical Citrix Recording Manager Vulnerabilities CVE-2024-8068 & CVE-2024-8069: Urgent Mitigation Required
The vulnerabilities in Citrix Recording Manager arise from two primary issues: the insecure serialization method using BinaryFormatter and an exposed Microsoft Message Queuing (MSMQ) service accessible via HTTP. Indicators of Compromise (IOCs) associated with the exploitation of these vulnerabilities may include unusual network traffic patterns directed at MSMQ services, unauthorized access attempts to Citrix environments, and unexpected changes in user privileges.

News

Weekly Detection Rule (YARA and Snort) Information – Week 3, November 2024
The following is the information on Yara and Snort rules (week 3, November 2024) collected and shared by the AhnLab TIP service. 1 YARA Rules Detection name Description Source MAL_ELF_Xlogin_Nov24_1 Detects xlogin backdoor samples https://github.com/Neo23x0/signature-base 4 Snort Rules Detection name Source ET WEB_SPECIFIC_APPS Symphony PHP Symfony Profiler Environment Manipulation (CVE-2024-50340) https://rules.emergingthreatspro.com/open/ ET WEB_SPECIFIC_APPS Citrix Session […] 게시물 Weekly Detection Rule (YARA and Snort) Information – Week 3, November 2024 이 ASEC 에 처음 등장했습니다.
Citrix Virtual Apps and Desktops Vulnerable to RCE Attack
According to Citrix, exploitation requires an authenticated user operating with NetworkService-level access. Specialists at watchTowr have released a proof of concept (PoC) demonstrating the exploitation of a remote code execution (RCE) vulnerability in Citrix Virtual Apps and Desktops.
Cybersecurity Threat Advisory: New critical Citrix vulnerabilities
New critical vulnerabilities in Citrix Virtual Apps and Desktops, tracked as CVE-2024-8068 and CVE-2024-8069, as well as new flaws involving MSMQ (Microsoft Message Queuing) misconfiguration, were discovered. In addition, the new flaws tied to MSMQ misconfigurations in Citrix environments allow attackers to send maliciously crafted messages to achieve RCE without authentication.
OSINT Cyber Threat Intelligence Database - ioc[.]one
Details CERT Ukraine 1 Details MITRE ATT&CK Techniques 79
THN Recap: Top Cybersecurity Threats, Tools, and Practices (Nov 11 - Nov 17)
It May Be Iranian Hackers: The Iranian threat actor known as TA455 is targeting LinkedIn users with enticing job offers intended to trick them into running a Windows-based malware named SnailResin . New Trends in Ransomware: A financially-motivated threat actor known as Lunar Spider has been linked to a malvertising campaign targeting financial services that employs SEO poisoning to deliver the Latrodectus malware, which, in turn, is used to deploy the Brute Ratel C4 (BRc4) post-exploitation framework.
See 58 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI