CVE-2024-8068: Citrix Session Recording Improper Privilege Management Vulnerability
Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
Other sources
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Follow applicable BOD 22-01 guidance for cloud services for any cloud deployments of Citrix Session Recording (per vendor remedy text).
- Compensating control
Restrict access to Citrix Session Recording servers to only trusted Windows Active Directory accounts and minimal network locations: enforce network segmentation and firewall/ACL rules to allow only approved management hosts, and limit which AD users/groups can authenticate to the session recording servers (reduce domain exposure since attacker must be an authenticated user in the same AD domain).
- Operational
Discontinue use of Citrix Session Recording if mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8068?
CVE-2024-8068 is considered a high severity vulnerability due to its potential for privilege escalation.
Who is affected by CVE-2024-8068?
CVE-2024-8068 affects authenticated users within the same Windows Active Directory domain as the Citrix Session Recording server.
How does CVE-2024-8068 exploit occur?
CVE-2024-8068 allows an authenticated user to escalate privileges to NetworkService Account access within Citrix Session Recording.
How do I fix CVE-2024-8068?
The fix for CVE-2024-8068 involves applying the latest security updates provided by Citrix for Session Recording.
What impact does CVE-2024-8068 have on security?
CVE-2024-8068 can lead to unauthorized access and control over sensitive data, posing significant security risks to affected systems.