FlagThis

A critical vulnerability, tracked as CVE-2024-8068 and CVE-2024-8069, has been discovered in Citrix StoreFront, also known as Citrix StoreWeb. This vulnerability could allow attackers to execute remote code if the StoreFront application is directly exposed to the internet and session recording is enabled. The vulnerability has been actively scanned for, but no signs of exploitation have been reported yet. Citrix has released patches to address the vulnerability. Organizations using Citrix StoreFront should prioritize applying the patches to mitigate the risk. The vulnerability highlights the importance of securing web applications and ensuring that they are properly configured, especially if they are exposed to the public internet.

References:

• @jos1264 - This post mentions the joint advisory issued by CISA, FBI, NSA, and international partners on 2023's top exploited vulnerabilities. - 8d
• Over Security - This article reports on the Five Eyes alliance's warning regarding the rise of zero-day exploits. It highlights the “new normal” of exploitation and emphasizes the importance of proactive patching - 8d
• All CISA Advisories - This joint advisory released by CISA, FBI, NSA, and international partners addresses the alarming increase in zero-day exploit activity. It outlines the top vulnerabilities exploited in 2023 and provi - 8d
• @GossiTheDog - If you present Citrix StoreFront aka Citrix StoreWeb directly to the internet and enabled session recording, you will want to drop everything and install patches for CVE-2024-8068 and CVE-2024-8069. P - 8d
• labs.watchtowr.com - Citrix have used terms like “limited RCE” and “intranet” 🤨 - 8d
• support.citrix.com - Citrix have used terms like “limited RCE” and “intranet” 🤨 - 8d
• News - CSO Online article urging Citrix admins to patch the vulnerabilities to prevent exploitation. - 7d
• Techzine Global - This story provides context for the importance of patching vulnerabilities, highlighting the case of the Snowflake hackers. - 6d

Classification:

• HashTags: Citrix CVE Vulnerability
• Company: Citrix
• Target: Citrix StoreFront users
• Product: StoreFront
• Feature: Session Recording
• Type: Vulnerability
• Severity: HighRisk