⚙️ Citrix Virtual Apps and Desktops — Unauthenticated RCE

This vulnerability in Citrix Virtual Apps and Desktops enables unauthorized users to achieve remote code execution through a misconfigured Microsoft Message Queuing (MSMQ) service accessible over HTTP. The issue stems from using an outdated BinaryFormatter for data deserialization, allowing attackers to run commands with SYSTEM privileges on the Citrix server.

🔗 Research:
https://labs.watchtowr.com/visionaries-at-citrix-have-democratised-remote-network-access-citrix-virtual-apps-and-desktops-cve-unknown/

🔗 Source:
https://github.com/watchtowrlabs/Citrix-Virtual-Apps-XEN-Exploit

#citrix #msmq #deserialization #unauth #rce