As Citrix recently informed its customers , the Workspace application contains a bug that, if exploited, could allow an attacker to hack a computer that has the application installed .
The vulnerability, known as CVE-2020-8207, has been rated as high severity and affects the automatic update service used by the Citrix Workspace app for Windows. The vulnerability could be exploited by both a local attacker to perform an escalation of privilege attack and a remote attacker to execute arbitrary code.
A researcher at Pen Test Partnerswas the first to discover the vulnerability. The company published a post explaining how the vulnerability could be exploited by a local attacker to escalate privileges and by a remote attacker to execute arbitrary code.
Pen Test Partners has shared some technical details, along with a video that shows how a malicious actor could exploit the vulnerability.
As Citrix reports, the flaw affects Citrix Workspace for Windows 1912 LTSR and 2002.To fix the bug, the company released versions 1912 LTSR CU1 and 2006.1.
Citrix noted that only the Windows version of the Workspace app is affected, and the vulnerability only exists if the app was installed using a local account . Remote attacks can only be carried out if SMB is enabled and the affected update service is running.
In the meantime, earlier this month Citrix informed its customers that it faced 11 vulnerabilities in the ADC, Gateway and SD-WAN networking products. Just a few days after the announcement of the fixes, the company discovered that there were malicious actors scanning the network for vulnerabilities.
Last week, the company denied claims that its systems had been hacked and some user information had been found on the Dark Web. The company clarified that the data came from a third party and claimed that it was not very sensitive.
