CVE-2024-8069
Citrix Session Recording Deserialization of Untrusted Data Vulnerability
Description
CVE-2024-8069 is a high-severity deserialization of untrusted data vulnerability in Citrix Session Recording that enables limited remote code execution with NetworkService account privileges. An authenticated user on the same intranet as the Session Recording server can exploit the insecure deserialization endpoint to execute arbitrary code on the target system. With a CVSS v3.1 base score of 8.0, CVE-2024-8069 is closely related to CVE-2024-8068 and together they form a potent attack chain against Citrix Session Recording infrastructure. CISA has added CVE-2024-8069 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 15, 2025, and its EPSS score of 48.29% at the 97th percentile indicates very high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | session recording | < 2407; 1912; 2203; 2402; 2407 |
References
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2024-8069 is classified under CWE-502 (Deserialization of Untrusted Data). This weakness occurs when an application deserializes data from an untrusted source without sufficient verification, allowing attackers to manipulate serialized objects to trigger code execution during the deserialization process. In Citrix Session Recording, an endpoint accepts serialized data from authenticated intranet users and deserializes it without adequate validation, enabling the attacker to craft a malicious payload that executes arbitrary code when processed.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2024-8069 has a severe impact profile with direct code execution consequences. The attack vector is adjacent network (AV:A), restricting exploitation to authenticated users on the same intranet as the Session Recording server. Attack complexity is low (AC:L), requiring only low privileges (PR:L) and no user interaction (UI:N). Confidentiality (High): Remote code execution with NetworkService privileges grants the attacker access to all session recordings, which frequently contain sensitive data including user credentials entered during recorded sessions, confidential business communications, and detailed audit logs of user activity. Integrity (High): The attacker can execute arbitrary commands on the server, enabling modification of recordings, installation of backdoors, and manipulation of the Session Recording infrastructure to facilitate further attacks. Availability (High): Code execution allows the attacker to crash the Session Recording service, corrupt stored data, or use the compromised server as a pivot point for lateral movement. The EPSS score of 48.29% at the 97th percentile indicates this vulnerability is among the most likely to be exploited, reflecting the high value of deserialization RCE vulnerabilities in enterprise environments.
Exploit Maturity
CVE-2024-8069 demonstrates very high exploit maturity. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 15, 2025. The EPSS score of 48.29% at the 97th percentile places it in the top 3% of all vulnerabilities by exploitation probability, indicating widespread and active exploitation. Deserialization vulnerabilities are a well-understood attack class with mature tooling such as ysoserial and similar gadget chain generators, which significantly lowers the barrier to exploitation. Citrix has published a combined security bulletin (CTX691941) addressing both CVE-2024-8069 and the related CVE-2024-8068. When chained with CVE-2024-8068's privilege escalation, an attacker can progress from a standard domain user account to full remote code execution on the Session Recording server, making this a high-priority remediation target.
Remediation
-
Apply the Citrix security update immediately. Install the patched version of Citrix Session Recording as specified in bulletin CTX691941. This update addresses both CVE-2024-8069 and the related CVE-2024-8068 privilege escalation.
-
Isolate the Session Recording server. Implement strict network segmentation to limit which systems can communicate with the Session Recording server. Block all inbound traffic from general user workstations and limit access to only the Citrix delivery controllers and authorized administrative systems.
-
Implement application-level defenses. Deploy web application firewall rules to detect and block deserialization attack payloads targeting the Session Recording endpoints. Monitor for .NET deserialization patterns in network traffic to the server.
-
Conduct forensic analysis. If the Session Recording server was accessible to intranet users while running a vulnerable version, check for signs of compromise including unauthorized processes, new user accounts, modified files, and unusual outbound network connections. Review Windows Event Logs for anomalous service behavior.
-
Harden the server environment. After patching, apply the principle of least privilege to the NetworkService account on the Session Recording server. Remove unnecessary permissions, disable unused services, and ensure logging is configured to capture authentication events, process creation, and network connections for ongoing monitoring.
Technical Details
CVE-2024-8069 is a deserialization of untrusted data vulnerability in Citrix Session Recording. The CVSS v3.1 vector string CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates an adjacent network attack with low complexity, requiring low privileges and no user interaction, with high impact across all CIA dimensions. The vulnerability exists in an endpoint of the Session Recording service that processes serialized .NET objects received from authenticated users on the intranet. The application deserializes these objects without implementing proper type restrictions or validation, allowing an attacker to submit a crafted serialized payload containing a malicious gadget chain. When the server deserializes this payload, the gadget chain triggers arbitrary code execution with the privileges of the NetworkService account. The .NET deserialization attack surface is well-documented, with established tools for generating gadget chain payloads that exploit common .NET libraries present on Windows servers. The scope is unchanged (S:U), confining the immediate impact to the Session Recording server, though the data and network position of this server often make it a valuable target for further lateral movement. Affected versions include Citrix Session Recording releases 1912, 2203, 2402, and versions before 2407.
Frequently Asked Questions
Is CVE-2024-8069 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2024-8069 by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 48.29% at the 97th percentile indicates it is among the most actively exploited vulnerabilities, reflecting the availability of mature deserialization exploitation tools.
What products are affected by CVE-2024-8069?
Citrix Session Recording versions 1912, 2203, 2402, and versions prior to 2407 are affected. The attacker must be an authenticated user on the same intranet as the Session Recording server.
How do I fix CVE-2024-8069?
Apply the Citrix security update from bulletin CTX691941. This patches both CVE-2024-8069 and the related CVE-2024-8068. Isolate the Session Recording server through network segmentation and conduct forensic analysis if the server was exposed while vulnerable.
How severe is CVE-2024-8069?
CVE-2024-8069 has a CVSS v3.1 base score of 8.0 (High severity). It enables remote code execution through insecure deserialization with NetworkService account privileges. When combined with CVE-2024-8068, the attack chain allows a standard domain user to achieve full code execution on the Session Recording server.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.