Citrix StoreFront Security Bulletin for CVE-2022-27503

A reflected cross-site scripting XSS issue has been discovered in Citrix StoreFront when it is configured to use SAML authentication. If exploited, this issue would allow an attacker to execute client-side JavaScript in the same context as a legitimate user. This issue has the following identifie...

Gateway page stuck after authentication on Chrome browser v100

- Citrix Gateway integration with Storefront -Custom Themes based on RFWEBUI, but may appear with others too - Observed at CVPN and Regular Storefront Integrations. -Chrome Version updated to 100.0.4896.60 Official Build 64-bit or later triggers the issue. - Page is stuck spinning circle...

Gateway Callback and / or XML Communication fails after upgrade to Storefront 2203

The issue occurs when customers upgrade from Storefront 1912 to 2203 and had TLS1.0 disabled prior to upgrading Does not occur on a clean install, or with TLS 1.0 enabled. In this scenario customers will encounter a TLS communication issue between Storefront and ADC / Storefront and Citrix Delive...

Citrix Gateway and StoreFront Error After Upgrade "There are no apps or desktops available to you at this time."

Customer had upgraded ADC firmware to 13.0.71.44 from 13.0.58.30 during a change window. Post-upgrade when they authenticate and login to their Citrix Gateway URL and land on StoreFront, they get a blank screen with no applications and desktops being displayed. The issue is seen on all browsers...

ADC 13.0 - Error : Please log on. The server met an error. Please try again or contact your administrator

Error after login to Citrix Gateway: "Please log on The server met an error. Please try again or contact your administrator" Logging in works fine internally through StoreFront server, but fails when trying to log on through Citrix Gateway. The session policy was noted to be looking for a referer...

Unable to upgrade the Storefront from 7.15 LTSR CU7 to CU8; fails with "An error occurred during installation. Please ensure all the required prerequisites have been installed and run the installer again."

Unable to upgrade the SF from 7.15 LTSR CU7 to CU8; fails with "An error occurred during installation. Please ensure all the required prerequisites have been installed and run the installer again."...

What steps are needed to configure new StoreFront servers with an existing Gateway and Store URL

The objective of this article is to provide the recommended steps at a high level in order to configure two new StoreFront servers to work with an existing Gateway virtual server that utilizes an URL created with an old set of StoreFront servers...

Citrix SF Server Group - Tech Query

Is it possible to change the name of a Storefront Server that already belongs to a Server Group? When a Storefront Server belongs to an SF Server Group, it is not possible to change its name and, it is not recommended to do it even if the Storefront Server does not belong to any SF Server Group d...

Storefront unable to communicate with Delivery controllers over HTTPS.

SSL Error on Storefront Event Logs:...

SSON not working with Microsoft Edge, Google Chrome and Firefox . Message "No logon methods are available on this platform" is seen.

After logging on to Chrome,Edge or Firefox this message is seen. No logon methods are available on this platform" After browsing to the Storefront URL a screen appears asking to detect if Citrix Workspace App ininstalled . Then this screen is seen...

Session launches fail with Workspace app 2112 for Windows

Some users experience a session launch failure with Workspace app 2112 for Windows. This may happen when administrators configure StoreFront customization for the field "ClientName" in default.ica...

Citrix ADC Deprecation of Web Interface on NetScaler (WIonNS) Feature

“From 12.1.63.22, 13.0.82.45 and 13.1.4.43 release, Web Interface on NetScaler WIonNS has been deprecated and sites using Citrix ADC’s Web Interface for accessing Citrix XenApp and Citrix XenDesktop applications need to move to Citrix StoreFront” The following configurations will be deprecated...

"Detect Receiver" is shown when launching Storefront URL from Edge or Chrome.

When launching Storefront URL from Edge or Chrome, "Detect Receiver" is shown. This issue doesn't happen within IE Browser...

Storefront upgrade error : 'Storefront cannot be upgraded because the following folders are in use by another program'

Storefront cannot be upgraded because the following folders are in use by another program. Close the program and try again: C:\inetpub\wwwroot\Citrix\apps\AppData C:\inetpub\wwwroot\Citrix\appsAuth...

The vulnerability of the corporate application store server, Citrix StoreFront, allows attackers to perform XXE attacks.

The vulnerability of the corporate application store server Citrix StoreFront is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

CVE-2021-41275

spreeauthdevise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spreeauthdevise is subject to a CSRF vulnerability that allows user account...

WordPress Storefront Footer Text plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Storefront Footer Text plugin in version 1.0.1 an...

CVE-2021-24607

The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed...

CVE-2021-24607

The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed...

Cross site scripting

The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed...