ctxpoliciesbypass.txt

`DESCRIPTION:  
============  
  
Vulnerability in Presentation Server allow to user bypass citrix policy  
which is applied to client name.  
  
  
  
SOFTWARE: Citrix Metaframe Presentation Server 3.0 / 4.0  
=========  
  
  
INFO:  
=====  
  
Citrix Presentation Server policy is used for admins to restrict the user  
environment  
and these allow applying to: IP client, servers, Users, o Client Name.  
  
When user used the Web Interface to access to application in citrix  
environment  
the CLIENT NAME used is WI_*, where (*) is a random value like  
asdfserw34vc342dk  
this extension allow admins to use citrix policy based in client name "WI_*"  
This policy can be used to restrict "printing Mapping, Disk Mapping,  
Control bandwidth, manage printer driver environment so..."  
  
  
  
VULNERABILITY:  
==============  
  
When user uses the application in Web interface, he download and execute  
automatic file "launch.ica"  
  
If the user "save as" launch.ica in his pc, and edit with notepad  
He can change the value in ClientName that another "WI_" and execute  
  
When user connects to citrix with ica file modified to Presentation  
Server, the value in clientname is different to the original one and  
bypasses the citrix policies.  
  
  
  
POC:  
====  
  
Here is an example extracted from launch.ica:  
  
[Encoding]  
  
InputEncoding=ISO8859_1  
  
[WFClient]  
  
Version=2  
  
ClientName=WI_XXXX -> change this extension with other name to bypass the  
citrix policies  
  
TransportReconnectEnabled=On  
  
RemoveICAFile=yes  
  
ProxyType=None  
  
ProxyTimeout=30000  
  
  
  
VENDOR STATUS:  
==============  
  
http://support.citrix.com/kb/entry!default.jspa?categoryID=275&externalID=CTX107705  
  
  
FIX:  
====  
  
No Hotfix released  
  
  
CREDITS:  
========  
  
This vulnerability was discovered and researched by  
Gustavo Gurmandi of GrupoITPro Security Research Community.  
  
  
  
mail : [email protected]  
  
web : http://www.grupoitpro.com.ar  
  
  
ORIGINAL ADVISORY:  
==================  
  
http://www.grupoitpro.com.ar/ctxpoliciesbypass.txt  
  
  
  
`