CVE-2021-22907: Citrix Workspace Privilege Escalation

CVE-2021-22907 Overview

CVE-2021-22907 is an improper access control vulnerability [CWE-284] in Citrix Workspace App for Windows. The flaw allows local attackers to escalate privileges on affected systems. It impacts Current Release (CR) versions prior to 2105 and 1912 Long Term Service Release (LTSR) prior to Cumulative Update 4 (CU4). Successful exploitation grants high impact on confidentiality, integrity, and availability of the target host. Citrix published advisory CTX307794 to address the issue.

Critical Impact
A local, low-privileged attacker can escalate privileges on Windows endpoints running vulnerable Citrix Workspace App builds, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Citrix Workspace App for Windows, Current Release versions prior to 2105
Citrix Workspace App for Windows, 1912 LTSR versions prior to CU4
Windows endpoints running Citrix Workspace components installed locally

Discovery Timeline

2021-05-27 - CVE-2021-22907 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-22907

Vulnerability Analysis

The vulnerability is an improper access control weakness in Citrix Workspace App for Windows. Access permissions on resources used by the Workspace App are not enforced correctly. A locally authenticated user can interact with those resources in ways that the application did not intend. The result is privilege escalation on the local system, where the attacker gains rights beyond those granted to the original user account. The advisory categorizes the weakness under [CWE-284] Improper Access Control. Because the attack vector is local and requires low privileges with no user interaction, an attacker already running code on the host can leverage the flaw to obtain higher-integrity execution. Citrix Workspace components frequently run with elevated privileges to handle session brokering, virtual channel mediation, and update operations, which makes any access control gap in this software a direct path to local system compromise.

Root Cause

The root cause is missing or insufficient access control enforcement on a resource exposed by the Citrix Workspace App installation. Citrix did not publish the precise component in the public advisory, but the CWE-284 mapping indicates that authorization checks were not performed where required.

Attack Vector

The attack vector is local. An attacker must already authenticate to the Windows host with low privileges. From that position, the attacker abuses the unprotected resource to execute code or perform actions in the security context of a higher-privileged account, escalating to administrative rights on the endpoint. No user interaction is required.

No public proof-of-concept code is available. See the Citrix Support Article CTX307794 for vendor technical details.

Detection Methods for CVE-2021-22907

Indicators of Compromise

Unexpected child processes spawned by Citrix Workspace App binaries (SelfServicePlugin.exe, Receiver.exe, wfica32.exe) running with elevated tokens
Modification of files or registry keys under the Citrix Workspace installation directory by non-administrative users
Local user accounts gaining membership in privileged groups shortly after Citrix Workspace activity

Detection Strategies

Inventory installed versions of Citrix Workspace App across Windows endpoints and flag any build below 2105 (CR) or 1912 CU4 (LTSR)
Monitor for process integrity level mismatches where a low-integrity caller triggers high-integrity execution through a Citrix Workspace component
Hunt for write operations to ACL-protected Citrix directories or services by standard user accounts

Monitoring Recommendations

Enable Windows Security and Sysmon event collection for process creation (Event ID 4688 / Sysmon 1) and file integrity changes (Sysmon 11) on Citrix Workspace paths
Alert on service or scheduled task modifications affecting Citrix Workspace components
Correlate local logon events with subsequent privilege changes on the same host

How to Mitigate CVE-2021-22907

Immediate Actions Required

Upgrade Citrix Workspace App for Windows to version 2105 or later on Current Release deployments
Upgrade 1912 LTSR deployments to 1912 CU4 or later
Restrict local logon rights on endpoints running Citrix Workspace to reduce the population of users who can exploit the flaw
Audit administrative group membership on endpoints for unexpected additions

Patch Information

Citrix released fixed builds described in advisory CTX307794. Apply Citrix Workspace App for Windows 2105 or newer on the Current Release track, or 1912 LTSR CU4 or newer on the Long Term Service Release track. Verify the installed build through Help > About in the Workspace App client or through software inventory tooling.

Workarounds

No vendor-supplied workaround is published; patching is the supported remediation path
Where immediate patching is not possible, limit interactive logon to trusted administrative users and enforce application allow-listing to block unauthorized binaries from executing on Citrix endpoints

bash

# Query installed Citrix Workspace App version on Windows endpoints
Get-ItemProperty HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Citrix Workspace*' } |
  Select-Object DisplayName, DisplayVersion, InstallDate