Black Arrow Cyber Advisory 17/06/2022 – Citrix ADM

Executive Summary

Citrix Application Delivery and Management (Citrix ADM), is a web-based software application used for managing Citrix deployments for an organisation.  Two vulnerabilities have been disclosed by Citrix, one of which could allow for a remote, unauthenticated user to reset the administrator password on the server, granting administrator access after a reboot.

What’s the risk to me or my business?

This vulnerability could lead to a remote user gaining privileged access to the system which facilitates Citrix deployments, which in turn could be used to access business data through these servers leading to further compromise.

What can I do?

Contact your Managed Service Provider to confirm if Citrix ADM (Hosted) is currently being used to manage Citrix deployments for you organisation and confirm if the vulnerability is being managed and patched in line with Citrix guidance. It is important to note that the Citrix ADM Service, which is the cloud solution, is not affected by this vulnerability. Only hosted solutions are affected.

Technical Summary

Only limited technical details have been supplied by Citrix so far relating to the two vulnerabilities. CVE-2022-27511, which currently does not have a CVS rating, allows a remote, unauthenticated user to corrupt a system which can lead to the reset of the administrator password on reboot, which they can then login with using the default credentials over SSH.

CVE-2022-27512, which also does not currently have a CVS rating, allows temporary disruption to the ADM license service, which can prevent new licences from being issued or renewed from the Citrix ADM.

Further details can be found here: Citrix Application Delivery Management Security Bulletin for CVE-2022-27511 and CVE-2022-27512

Need help understanding your gaps, or just want some advice? Get in touch with us.