We use cookies to improve your experience on our site and enable certain core website functionalities. For more information, visit our Privacy Policy page.

Accept
  • Insights

Citrix StoreFront Security Bulletin

Jeff Silverman

2 min read

All Insights

Issue

A reflected cross-site scripting (XSS) issue has been discovered in Citrix StoreFront when it is configured to use SAML authentication. If exploited, this issue would allow an attacker to execute client-side JavaScript in the same context as a legitimate user. This issue has the following identifier:

CVD-ID Description CWE Affected Products
CVE-2022-27503 Reflected Cross-Site Scripting (XSS) CWE-79: Improper Neutralization of Input During Web Page Generation (cross-site scripting) Citrix StoreFront

Citrix Virtual Apps and Desktops


To review all 4 Citrix vulnerabilities announced on April 12th, please read our digest.

Affected versions

The issue affects the following supported versions of Citrix StoreFront:

  • Citrix StoreFront 1912 LTSR up to and including CU4 (1912.0.4000)
  • Citrix StoreFront 3.12 for 7.15 LTSR up to and including CU8 (3.12.8000)

Affected versions of Citrix Storefront are included within the following supported versions of Citrix Virtual Apps and Desktops:

  • Current Release (CR) versions of Citrix Virtual Apps and Desktops up to and including 2112
  • Citrix Virtual Apps and Desktops 1912 LTSR up to and including CU4
  • Citrix XenApp & XenDesktop 7.15 LTSR up to and including CU8

Mitigating Factors

This issue only exists when Citrix StoreFront is configured to use SAML authentication. StoreFront deployments that have not been configured to use SAML authentication are unaffected.

Recommended Action

Citrix recommends that affected customers upgrade to a fixed version as their patching schedule allows.

The issue has been addressed in the following supported Citrix StoreFront versions:

  • Citrix StoreFront 2203 LTSR (2203.0.0) and later versions
  • Citrix StoreFront 1912 LTSR CU5 (1912.0.5000) and later cumulative updates for 1912 LTSR

The latest versions of Citrix StoreFront can be downloaded from https://www.citrix.com/downloads/storefront/

These versions of Citrix StoreFront are included within the following supported versions of Citrix Virtual Apps and Desktops:

  • Citrix Virtual Apps and Desktops 2203 LTSR and later versions
  • Citrix Virtual Apps and Desktops 1912 LTSR CU5 and later cumulative updates for 1912 LTSR

The latest versions of Citrix Virtual Apps and Desktops can be downloaded from https://www.citrix.com/downloads/citrix-virtual-apps-and-desktops/

A hotfix has been released to address this issue for Citrix StoreFront 3.12 for 7.15 LTSR.

The hotfix for Citrix StoreFront 3.12 for 7.15 LTSR is available at https://support.citrix.com/article/CTX446966

More Information

https://support.citrix.com/article/CTX377814

For assistance from the Kraft Kennedy team, please contact us.