CVE-2020-13884: Citrix Workspace App Privilege Escalation

CVE-2020-13884 Overview

CVE-2020-13884 is a local privilege escalation vulnerability affecting Citrix Workspace App for Windows. The vulnerability stems from a combination of Insecure Permissions (CWE-276) and an Unquoted Path vulnerability, which allows local users to gain elevated privileges during the uninstallation process of the application.

Critical Impact

Local attackers with limited privileges can exploit insecure permissions and unquoted service paths to escalate privileges to SYSTEM level during the Citrix Workspace App uninstallation process.

Affected Products

• Citrix Workspace App for Windows versions prior to 1912
• Windows installations with default Citrix Workspace App configurations
• Enterprise environments using centralized Citrix deployments

Discovery Timeline

• 2020-06-08 - CVE-2020-13884 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-13884

Vulnerability Analysis

This vulnerability combines two distinct weaknesses that together enable local privilege escalation. The first issue involves insecure file system permissions that allow unprivileged users to write to directories used by the application during its uninstallation routine. The second issue is an unquoted service path vulnerability, where the installer or uninstaller references executable paths containing spaces without proper quotation marks.

When Windows parses an unquoted path containing spaces (e.g., C:\Program Files\Citrix\...), it attempts to execute files at each space-delimited segment. An attacker can plant a malicious executable (such as C:\Program.exe or C:\Program Files\Citrix.exe) that will be executed with elevated privileges when the uninstallation process runs.

Root Cause

The root cause is twofold: First, the application sets improper Access Control Lists (ACLs) on directories or files involved in the uninstallation process, violating the principle of least privilege. Second, the uninstaller service or scheduled task references paths without enclosing them in quotation marks, allowing path traversal exploitation. This is classified under CWE-276 (Incorrect Default Permissions).

Attack Vector

This is a local attack vector requiring the attacker to have authenticated access to the target Windows system. The exploitation occurs during the uninstallation phase of Citrix Workspace App, where the attacker can:

1. Identify the insecurely permissioned directories in the Citrix installation path
2. Place a malicious executable at a location that matches the unquoted path parsing behavior
3. Wait for or trigger the uninstallation process
4. The malicious binary executes with elevated (typically SYSTEM) privileges

Technical details and proof-of-concept information are available in the GitHub PoC Repository.

Detection Methods for CVE-2020-13884

Indicators of Compromise

• Unexpected executable files appearing in root directories such as C:\Program.exe or within the C:\Program Files\ hierarchy with non-standard names
• New processes spawning from unusual locations during Citrix Workspace App uninstallation
• Anomalous privilege escalation events correlating with Citrix uninstallation activities
• File creation events in directories along the Citrix installation path by non-administrative users

Detection Strategies

• Monitor for file creation events in C:\, C:\Program Files\, and Citrix installation directories by low-privileged users
• Configure endpoint detection to alert on process execution from unexpected paths during software uninstallation
• Audit service configurations for unquoted paths using tools like PowerShell or specialized scanning utilities
• Review Windows Security Event logs for privilege escalation indicators (Event IDs 4672, 4688)

Monitoring Recommendations

• Enable command-line auditing and process creation logging (Event ID 4688) with command-line arguments
• Deploy file integrity monitoring on critical system directories and the Citrix installation path
• Configure alerts for process execution anomalies during maintenance windows or uninstallation activities
• Regularly audit installed software for unquoted service path vulnerabilities using automated scanning

How to Mitigate CVE-2020-13884

Immediate Actions Required

• Upgrade Citrix Workspace App to version 1912 or later immediately
• Audit existing Citrix installations for insecure ACLs and remediate permissions
• Scan for suspicious executables in root and Program Files directories that could be exploited
• Restrict write access to directories in the PATH environment variable and common installation locations

Patch Information

Citrix has addressed this vulnerability in Citrix Workspace App version 1912 and later releases. Organizations should upgrade to the latest available version to receive comprehensive security fixes. Detailed remediation guidance is available in the Citrix Support Article.

Workarounds

• Manually quote all service paths in the Windows registry for Citrix-related services using regedit or PowerShell
• Restrict write permissions on the root drive and Program Files directories to administrators only
• Remove any unauthorized executable files found in exploitable path locations
• Consider temporarily restricting local user access to affected systems until patching is complete

# PowerShell command to identify unquoted service paths on Windows systems
Get-WmiObject Win32_Service | Where-Object {$_.PathName -notlike '"*' -and $_.PathName -like '* *'} | Select-Object Name, PathName