CVE-2024-42423

Vulnerability

Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. This flaw allows a local unauthenticated user with low privileges to bypass intended access controls [1].

Exploitation

An attacker must have local low-privilege access to the affected Dell ThinOS system where Citrix Workspace App is installed and Citrix CEB is enabled for WebLogin. No authentication is required beyond existing low-privilege access; the attacker can exploit the incorrect authorization check to perform actions that should be restricted.

Impact

Successful exploitation leads to unauthorized actions, specifically information disclosure and tampering. The attacker gains the ability to read sensitive information and modify data that should be protected, without needing higher privileges [1].

Mitigation

Dell has released a security update addressing this vulnerability as part of DSA-2024-229. Users should apply the latest updates for Dell ThinOS. No workaround was disclosed in the available references. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [1].