Moderate
CVE-2020-8200
Add Reference
Description
URL
Type
Moderate
(1 user assessed)
Low
(1 user assessed)Unknown
Unknown
Unknown
CVE-2020-8200
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Description
Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server.
Add Assessment
Ratings
-
Attacker ValueMedium
-
ExploitabilityLow
Technical Analysis
This is still a provisional assessment pending more research.
A high severity issue has been discovered in Citrix StoreFront that, if exploited, would allow an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server.
This CVE is for Citrix StoreFront that allows an authenticated user to gain arbitrary file read on to the StoreFront server. This could lead to further compromise depending on the ability to exploit data recovered from the server.
The official statement from Citrix can be found here. https://support.citrix.com/article/CTX277455
Updates are availaible
- Citrix StoreFront 1912 CU1 (1912.0.1000) and later versions of Citrix StoreFront 1912 LTSR
- Citrix StoreFront 3.0 for 7.6 LTSR CU8 Hotfix (3.0.8001) and later versions of StoreFront 3.0 for 7.6 LTSR
- Citrix StoreFront 3.12 for 7.15 LTSR CU5 Hotfix (3.12.5001) and later versions of StoreFront 3.12 for 7.15 LTSR
The advisory states that attackers must be authenticated in the same Microsoft Active Directory domain as the StoreFront server, if not this vulnerability is not exploitable.
This significantly impacts the ability for an attacker to exploit this vulnerability. An attacker would have to be:
- An insider threat with technical knowledge
- An attacker that already has authenticated access to the domain
General Information
Products
- Citrix StoreFront
References
Miscellaneous
Additional Info
Technical Analysis
Report as Exploited in the Wild
What do we mean by "exploited in the wild"?
By selecting this, you are verifying to the AttackerKB community that either you, or a reputable source (example: a security vendor or researcher), has observed an active attempt by attackers, or IOCs related, to exploit this vulnerability outside of a research environment.
A vulnerability should also be considered "exploited in the wild" if there is a publicly available PoC or exploit (example: in an exploitation framework like Metasploit).
