CVE-2019-11634

What is Citrix Workspace Application?

Citrix Workspace Application (and its predecessor, Citrix Receiver) is the client software end users install on their own devices to connect to remote virtual desktops and published applications hosted on Citrix infrastructure — a setup common in enterprises that centralize desktops for security or manageability reasons. One of its features, Client Drive Mapping (CDM), lets a remote session read and write files on the local user's actual hard drive, which is powerful functionality that must be carefully sandboxed to the folders the user has explicitly authorized.

Overview

CVE-2019-11634 is a remote code execution vulnerability in Citrix Workspace Application and Receiver for Windows caused by the client failing to properly enforce a user's configured local-drive-access restrictions during a session. A malicious or compromised remote Citrix server that a victim connects to can abuse the Client Drive Mapping feature to write files to arbitrary locations on the client's local filesystem outside the folders the user intended to share — for example, dropping an executable into a startup folder — leading to code execution on the client machine.

Technical Details

The flaw is a client-side trust boundary failure: Workspace App/Receiver is meant to restrict CDM file operations to only the local folders a user has explicitly mapped for a given session, but insufficient enforcement lets the server-side session write files to other locations on the client's disk. Because the attack requires a user's Citrix client to connect to an attacker-controlled or attacker-compromised published desktop/application (an unusual but realistic scenario in Citrix-as-a-service, shared-hosting, or compromised-server situations), user interaction is required, but no authentication beyond the normal Citrix session is needed for the malicious server side to act.

Discovery

Citrix disclosed and patched this vulnerability itself in coordination with the CVE assignment in May 2019; the specific external researcher is not distinctly credited in the public advisory.

Exploitation Context

This bug is most relevant in scenarios where a Citrix session's remote endpoint (the published desktop or application) is under attacker control — such as a compromised hosted-desktop provider, a malicious insider with access to publish applications, or a supply-chain-style compromise of a Citrix farm. Its CISA KEV listing confirms it has been used in real-world attacks, consistent with its inclusion alongside other Citrix vulnerabilities that were actively targeted in the broader wave of Citrix exploitation activity in 2019-2020.

Remediation

1. Update Citrix Workspace Application / Receiver for Windows to the patched version referenced in Citrix's May 2019 security bulletin.
2. Disable Client Drive Mapping entirely for sessions where local drive access is not a business requirement.
3. Restrict which published applications and desktops users are permitted to connect to, minimizing exposure to untrusted or externally-hosted Citrix environments.
4. Treat any Citrix server infrastructure a client connects to as part of the trust boundary — apply the same integrity and monitoring controls to hosted desktop farms as to any other production system.
5. Monitor client endpoints for unexpected file writes to startup folders or other autorun locations following Citrix session activity.