CVE-2024-8069: medium-severity vulnerability in Citrix Session Recording
Limited remote code execution with privilege of a NetworkService Account access
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Citrix Session Recording allows an authenticated user on the same network to execute limited code with NetworkService account privileges. This matters because an attacker who gains access to the internal network could run malicious commands with elevated permissions.
CWE-502 (deserialization vulnerability) in Citrix Session Recording permits remote code execution with NetworkService-level privileges when an authenticated attacker on the same intranet sends malicious serialized objects to the recording server. Exploitation requires network access and valid authentication credentials; impact is limited to the privileges of the NetworkService account.
The full analysis of this CVE is available in Portuguese →