CVE-2020-13884: Citrix Workspace App Privilege Escalation

CVE-2020-13884 Overview

CVE-2020-13884 is a local privilege escalation vulnerability affecting Citrix Workspace App for Windows. The vulnerability stems from a combination of Insecure Permissions (CWE-276) and an Unquoted Path vulnerability, which allows local users to gain elevated privileges during the uninstallation process of the application.

Critical Impact
Local attackers with limited privileges can exploit insecure permissions and unquoted service paths to escalate privileges to SYSTEM level during the Citrix Workspace App uninstallation process.

Affected Products

Citrix Workspace App for Windows versions prior to 1912
Windows installations with default Citrix Workspace App configurations
Enterprise environments using centralized Citrix deployments

Discovery Timeline

2020-06-08 - CVE-2020-13884 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-13884

Vulnerability Analysis

This vulnerability combines two distinct weaknesses that together enable local privilege escalation. The first issue involves insecure file system permissions that allow unprivileged users to write to directories used by the application during its uninstallation routine. The second issue is an unquoted service path vulnerability, where the installer or uninstaller references executable paths containing spaces without proper quotation marks.

When Windows parses an unquoted path containing spaces (e.g., C:\Program Files\Citrix\...), it attempts to execute files at each space-delimited segment. An attacker can plant a malicious executable (such as C:\Program.exe or C:\Program Files\Citrix.exe) that will be executed with elevated privileges when the uninstallation process runs.

Root Cause

The root cause is twofold: First, the application sets improper Access Control Lists (ACLs) on directories or files involved in the uninstallation process, violating the principle of least privilege. Second, the uninstaller service or scheduled task references paths without enclosing them in quotation marks, allowing path traversal exploitation. This is classified under CWE-276 (Incorrect Default Permissions).

Attack Vector

This is a local attack vector requiring the attacker to have authenticated access to the target Windows system. The exploitation occurs during the uninstallation phase of Citrix Workspace App, where the attacker can:

Identify the insecurely permissioned directories in the Citrix installation path
Place a malicious executable at a location that matches the unquoted path parsing behavior
Wait for or trigger the uninstallation process
The malicious binary executes with elevated (typically SYSTEM) privileges

Technical details and proof-of-concept information are available in the GitHub PoC Repository.

Detection Methods for CVE-2020-13884

Indicators of Compromise

Unexpected executable files appearing in root directories such as C:\Program.exe or within the C:\Program Files\ hierarchy with non-standard names
New processes spawning from unusual locations during Citrix Workspace App uninstallation
Anomalous privilege escalation events correlating with Citrix uninstallation activities
File creation events in directories along the Citrix installation path by non-administrative users

Detection Strategies

Monitor for file creation events in C:\, C:\Program Files\, and Citrix installation directories by low-privileged users
Configure endpoint detection to alert on process execution from unexpected paths during software uninstallation
Audit service configurations for unquoted paths using tools like PowerShell or specialized scanning utilities
Review Windows Security Event logs for privilege escalation indicators (Event IDs 4672, 4688)

Monitoring Recommendations

Enable command-line auditing and process creation logging (Event ID 4688) with command-line arguments
Deploy file integrity monitoring on critical system directories and the Citrix installation path
Configure alerts for process execution anomalies during maintenance windows or uninstallation activities
Regularly audit installed software for unquoted service path vulnerabilities using automated scanning

How to Mitigate CVE-2020-13884

Immediate Actions Required

Upgrade Citrix Workspace App to version 1912 or later immediately
Audit existing Citrix installations for insecure ACLs and remediate permissions
Scan for suspicious executables in root and Program Files directories that could be exploited
Restrict write access to directories in the PATH environment variable and common installation locations

Patch Information

Citrix has addressed this vulnerability in Citrix Workspace App version 1912 and later releases. Organizations should upgrade to the latest available version to receive comprehensive security fixes. Detailed remediation guidance is available in the Citrix Support Article.

Workarounds

Manually quote all service paths in the Windows registry for Citrix-related services using regedit or PowerShell
Restrict write permissions on the root drive and Program Files directories to administrators only
Remove any unauthorized executable files found in exploitable path locations
Consider temporarily restricting local user access to affected systems until patching is complete

bash

# PowerShell command to identify unquoted service paths on Windows systems
Get-WmiObject Win32_Service | Where-Object {$_.PathName -notlike '"*' -and $_.PathName -like '* *'} | Select-Object Name, PathName