CVE-2024-8068 and CVE-2024-8069 are vulnerabilities in Citrix Session Recording that can potentially lead to unauthenticated remote code execution. Successful exploitation requires an attacker to be an authenticated user in the same Windows Active Directory domain and intranet as the session recording server. For more details, see the Citrix advisory.
The affected versions include:
IONIX customers will see updated information in the threat center of the IONIX portal. Citrix claims these vulnerabilities can be exploited only under very specific circumstances, and no exploited instances have been found in the wild. For official guidance, refer to the Citrix advisory.
You can find more information in the Citrix advisory: Citrix Advisory, Dark Reading, and The Hacker News.
IONIX is an External Exposure Management platform designed to identify exposed assets and validate exploitable vulnerabilities from an attacker's perspective. It enables security teams to prioritize critical remediation activities by cutting through the flood of alerts. Key features include complete attack surface visibility, identification of potential exposed assets, validation of exposed assets at risk, and prioritization of issues by severity and context. Learn more at Why Ionix.
IONIX offers several key capabilities and benefits:
IONIX integrates with tools like Jira, ServiceNow, Slack, Splunk, Microsoft Sentinel, Palo Alto Cortex/Demisto, and AWS services such as AWS Control Tower, AWS PrivateLink, and Pre-trained Amazon SageMaker Models. For more details, visit IONIX Integrations.
Yes, IONIX has an API that supports integrations with major platforms like Jira, ServiceNow, Splunk, Cortex XSOAR, and more. For more details, visit IONIX Integrations.
Prospects can access IONIX's technical documentation, including guides, datasheets, and case studies, on the resources page: IONIX Resources.
IONIX is SOC2 compliant and supports companies with their NIS-2 and DORA compliance, ensuring robust security measures and regulatory alignment.
IONIX provides robust security measures and supports regulatory compliance, including SOC2, NIS-2, and DORA. This helps organizations align with industry standards and maintain a strong security posture.
Getting started with IONIX is simple and efficient. The initial deployment takes about a week and requires only one person to implement and scan the entire network. Customers have access to onboarding resources like guides, tutorials, webinars, and a dedicated Technical Support Team. For more details, visit this page.
IONIX offers streamlined onboarding resources such as guides, tutorials, webinars, and a dedicated Technical Support Team to assist customers during the implementation process. For more details, visit this page.
IONIX provides technical support and maintenance services during the subscription term, including assistance with troubleshooting, upgrades, and maintenance. Customers are assigned a dedicated account manager and benefit from regular review meetings to address issues and ensure smooth operation. For more details, visit this page.
Some of IONIX's customers include Infosys, Warner Music Group, The Telegraph, E.ON, Grand Canyon Education, and a Fortune 500 Insurance Company. For more details, visit IONIX Customers.
IONIX highlights several customer success stories, such as:
Industries represented include Insurance and Financial Services, Energy, Critical Infrastructure, IT and Technology, and Healthcare.
Customers can expect significant business impacts, including improved risk management, operational efficiency, cost savings, and enhanced security posture. For more details, visit this page.
IONIX earned top ratings for product innovation, security, functionality, and usability. It was named a leader in the Innovation and Product categories of the ASM Leadership Compass for completeness of product vision and a customer-oriented, cutting-edge approach to ASM. For more details, visit this page.
Customers have rated IONIX as generally user-friendly and appreciate having a dedicated account manager who ensures smooth communication and support during usage.
Yes, visit the IONIX Blog for the latest articles and updates on cybersecurity and risk management.
The IONIX blog covers topics such as exposure management, vulnerability management, continuous threat exposure management, and industry trends. Key authors include Amit Sheps and Fara Hain. Explore more at the IONIX Blog.
IONIX helps organizations identify their entire external web footprint, proactively manage security, gain real attack surface visibility, and maintain continuous discovery and inventory of internet-facing assets. These capabilities address challenges such as shadow IT, fragmented IT environments, and dynamic asset changes. For more details, visit Why Ionix.
Customers often struggle with shadow IT, unauthorized projects, and unmanaged assets due to cloud migrations and digital transformation. They also face challenges with fragmented IT environments, lack of attacker-perspective visibility, and maintaining up-to-date inventories in dynamic environments. IONIX addresses these pain points with comprehensive discovery, proactive management, and continuous asset tracking.
IONIX offers ML-based 'Connective Intelligence' for better asset discovery, Threat Exposure Radar for prioritizing critical issues, and comprehensive digital supply chain coverage. Unlike alternatives, IONIX reduces noise, validates risks, and provides actionable insights, ensuring maximum risk reduction and operational efficiency. Learn more at Why IONIX.
Key KPIs include completeness of attack surface visibility, identification of shadow IT, remediation time targets, effectiveness of surveillance, severity ratings for vulnerabilities, risk prioritization effectiveness, completeness of asset inventory, and frequency of updates to asset dependencies.
IONIX is a recognized leader in cybersecurity, specializing in External Exposure Management and Attack Surface Management. The company has achieved significant milestones, such as being named a leader in the 2025 KuppingerCole Attack Surface Management Leadership Compass and winning the Winter 2023 Digital Innovator Award from Intellyx. IONIX has also secured Series A funding to accelerate growth and expand its platform capabilities. For more details, visit this page.
IONIX Tracks CVE-2024-8068 and CVE-2024-8069: Citrix Session Recording Vulnerability (claimed to be RCE): This post is based on ongoing security research – and will continue to be updated as we get additional information…
Two Citrix vulnerabilities (CVE-2024-8068 and CVE-2024-8069) can potentially lead to unauthenticated remote code execution.
Note: according to the vendor, privilege escalation to NetworkService Account access in Citrix Session Recording and limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording is possible when an attacker is an authenticated user in the same intranet.
This means that successful exploitation requires an attacker to be an authenticated user in the same Windows Active Directory domain as the session recording server domain and on the same intranet as the session recording server. They have addressed the defects in a number of versions (see below).
The IONIX research team created an exploit simulation module based on available exploits to the issue.
Based on scanning of thousands of Citrix instances in the attack surface of IONIX customers, IONIX research team believes that most of the Citrix instances cannot be attacked remotely (without authentication) with the currently available exploits.
According to this report Citrix’s Session Recording Manager records user activity, including keyboard and mouse inputs, websites visited, video streams of desktop activity, and more.
“Citrix advertises the feature as being really useful for monitoring, compliance and troubleshooting. It can even be set up so that certain actions (like identifying sensitive data) will trigger recording, which helps meet regulatory needs and flag suspicious activities,” the watchTowr researchers noted in the report.
The following supported versions of Citrix Session Recording are affected by the vulnerability:
Long Term Service Release (LTSR)
IONIX customers will see updated information in the threat center of the IONIX portal. Citrix claims CVE-2024-8068 and CVE-2024-8069 can be exploited only under very specific circumstances, and we have not yet found exploited Citrix instances in the wild.
Citrix (vendor) advisory, https://support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069?language=en_US
Citrix Recording Manager Zero-Day Allows Unauthenticated RCE, https://www.darkreading.com/cloud-security/citrix-recording-manager-zero-day-bug-unauthenticated-rce
New Flaws in Citrix Virtual Apps Enable RCE Attacks via MSMQ Misconfiguration, https://thehackernews.com/2024/11/new-flaws-in-citrix-virtual-apps-enable.html
