Introducing CVE-2023-24489: A Critical Citrix Share File RCE Vulnerability

Summary: Citrix ShareFile's Storage Zones Controller, a .NET web application running under IIS, carries CVE-2023-24489, a cryptographic bug in its handling of AES encryption with CBC mode and PKCS7 padding that fails to correctly validate decrypted data, allowing unauthenticated arbitrary file upload and remote code execution. The flaw carries a CVSS score of 9.8, Assetnote researchers published the first proof-of-concept, other PoCs have appeared on GitHub, and GreyNoise observed a significant spike in attacker activity the day CISA added the CVE to its Known Exploited Vulnerabilities Catalog, with two of the exploiting IPs never seen by GreyNoise before.
Key Takeaway: A 9.8 unauthenticated RCE with public proof-of-concept code and confirmed exploitation in the wild means the window between disclosure and attack is already closed for anyone still running an unpatched Storage Zones Controller; the fix is version 5.11.24 and later.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-24489
Related: CVE-2023-24489: Citrix Content Collaboration Share File Improper Access Control Vulnerability Known Exploited Vulnerabilities · Aug 16, 2023
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026