Is Your Citrix StoreFront Vulnerable to Exploit?

On September 14, Citrix pushed out an announcement around a high-severity security vulnerability Citrix StoreFront customers should be aware of. An issue has been discovered in Citrix StoreFront (before 2006) that, if exploited, would allow an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server.

This issue has the following identifier: CVE-2020-8200.

The issue affects the following supported Long Term Service Release (LTSR) versions of Citrix StoreFront:

• Citrix StoreFront 1912 LTSR before CU1 (1912.0.1000)
• Citrix StoreFront 3.12 for 7.15 LTSR before CU5 Hotfix (3.12.5001)
• Citrix StoreFront 3.0 for 7.6 LTSR before CU8 Hotfix (3.0.8001)

Citrix StoreFront is included in deployments of Citrix Virtual Apps and Citrix Virtual Apps and Desktops as an infrastructure component, if you have Citrix Virtual Apps or Citrix Virtual Apps and Desktops then you have Citrix StoreFront deployed in your environment today. Also, customers running Citrix Virtual Apps and Desktops 2003 should be aware that the version of Citrix StoreFront included in that release, 1912 LTSR, is one of the affected versions.

If users are not in the same Microsoft Active Directory domain as the Citrix StoreFront server, the vulnerability is not exploitable, even if the users are authenticated in a transitively trusted domain. Note that this applies even if the user is logged into the Citrix StoreFront server.

What Should You Do if Your Version of Citrix StoreFront is Impacted?

Citrix has addressed this issue in the following Citrix StoreFront versions:

• Citrix StoreFront 1912 CU1 (1912.0.1000) and later versions of Citrix StoreFront 1912 LTSR
• Citrix StoreFront 3.0 for 7.6 LTSR CU8 Hotfix (3.0.8001) and later versions of StoreFront 3.0 for 7.6 LTSR
• Citrix StoreFront 3.12 for 7.15 LTSR CU5 Hotfix (3.12.5001) and later versions of StoreFront 3.12 for 7.15 LTSR

Any customers running an affected version of Citrix StoreFront, both CR and LTSR versions, should upgrade as soon as possible.

The latest versions of Citrix StoreFront can be downloaded from the following URLs:

• https://www.citrix.com/downloads/storefront/ 
• https://support.citrix.com/article/CTX277537 
• https://support.citrix.com/article/CTX277538

Earlier this year, another Citrix vulnerability resulted in numerous compromised systems and hours of remediation work for organizations that were slow to fix it. Don’t let this happen to you. If this vulnerability applies to you, it’s time to update. If you have any questions or would like to talk to a OneNeck expert about your Citrix StoreFront, we are here to help.