A vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows). If exploited, this issue would allow an adversary, who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM. This issue has the following identifier:
CVE-ID
Description
CWE
Pre-conditions
CVE-2022-21827
Arbitrary corruption or deletion of files as SYSTEM
CWE-284: Improper Access Control
Local access to a machine that has the vulnerable plug-in installed
The following supported versions of Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) are affected by this vulnerability:
Citrix Gateway Plug-in for Windows versions before 21.9.1.2
What Customers Should Do
This issue has been addressed in the following versions of Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows):
Citrix Gateway Plug-in for Windows version 21.9.1.2 and later releases
Nach Update des Chrome oder chromium basierende Browser auf die Version 100.0.4896.60 bekommen User nach der Anmeldung am Citrix Gateway ein «spinning circle» und nicht die published Apps angezeigt. Das Problem tritt aufgrund einer Inkompatibilität mit den Citrix ADC Custom Themes auf.
Betroffen ist die Citrix ADC/Gateway Version 13.0 83.29
Systeme mit Citrix ADC/Gateway Version 13.1 12.50 und höher sind nicht betroffen. Ebenfalls nicht betroffen sind Firefox, Apple Safari Browser und ältere Chrome/Chromium Browser.
Google Chrome hat nach kurzer Zeit eine neue Aktualisierung des Chrome Browsers zur Verfügung gestellt. Die neue Version schliesst wieder eine Lücke in der JavaScript Engine V8 (Type Confusion» (CVE-2022-1232). Google stuft die Lücke als «hoch» ein.
Google hat hierzu die Version «100.0.4896.75» für Windows, Linux und Mac veröffentlicht. Microsoft hat ebenfalls eine neue Version des Chromium basierenden Edge Browser veröffentlicht.
A zero-day exploit affecting the Spring Framework versions (5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions was made public on March 30, 2022, allowing an unauthenticated attacker to execute arbitrary code on the target system.
Citrix recommends that customers hosting affected web applications follow Spring’s recommendations. In addition, Citrix Web App Firewall (WAF) customers should consider the following recommendations to improve the security of their applications from this vulnerability.
The Citrix research team has released updated Citrix WAF signatures designed to mitigate in part the CVE-2022-22963, CVE-2022-22965 vulnerability. If you are using any of these Spring Framework versions (5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions), Citrix strongly recommends that you download the signatures version 79 and apply to your Citrix WAF deployments as an additional layer of protection for your applications. Signatures are compatible with the following software versions of Citrix Application Delivery Controller (ADC) 11.1, 12.0, 12.1, 13.0 and 13.1. Please note, versions 11.1 and 12.0 are end of life.
Citrix ADC Produkte sind selber nicht von der Sicherheitslücke betroffen.
Für alle Kunden, welche WAF nicht im Einsatz haben, gibt es auch eine Empfehlung seitens Citrix, die Sicherheitslücke mittels Responder Policy zu minimieren:
Citrix ADC Standard and Advanced edition customers, as well as Premium edition customers who do not have WAF signatures enabled, can use responder policies for protection as shown below. Please bind the responder policy to the appropriate bind point (vserver or global).
add responder policy mitigate_cve_2022_22963_22965 q^(HTTP.REQ.FULL_HEADER. SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.
CONTAINS("spring.cloud.function.routing-expression") || HTTP.REQ.BODY(8192).SET_TEXT_MODE(URLENCODED).DECODE_USING_TEXT_MODE.CONTAINS(".classLoader"))^ DROP
Citrix recommends that Citrix WAF customers use the latest signature version, enable signatures auto-update, and subscribe to receive signature alert notifications. Citrix will continue to monitor this dynamic situation and update as new mitigations become available.
If any of your application availability is inadvertently impacted due to false positives resulting from above mentioned mitigation policies, Citrix recommends the following modifications to the policy. Please note that any end point covered by the exception_list may expose those assets to the risks from CVE-2022-22963, CVE-2022-22965.
