The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has just added an actively exploited critical vulnerability in the Citrix ShareFile storage zones controller to the Known Exploited Vulnerabilities (KEV) catalog. The addition mandates that all Federal Civilian Executive Branch (FCEB) agencies become compliant by patching their vulnerable infrastructure by no later than September 6, 2023, or be held accountable by the regulators. ShareFile is a managed cloud-based file transfer and collaboration solution allowing organizations to share data internally as well as with their clients and partners. Storage zones controller extends the ShareFile Software-as-a-Service (SaaS) cloud storage by providing enterprise entities with ShareFile accounts to configure private data storage to host files. The flaw, tracked as CVE-2023-24489, has a CVSS score of 9.8/10 and is described as an improper access control bug. Successful exploitation of this vulnerability could allow unauthenticated threat actors to compromise the customer-managed ShareFile storage zones controller remotely and upload malicious arbitrary files. The flaw was discovered by the cybersecurity firm AssetNote, who published a working proof-of-concept (PoC) exploit, which is successful due to errors in ShareFile’s AES encryption. They state that the vulnerability has been patched, and CTIX analysts recommend that all Citrix ShareFile administrators ensure their software is up to date with the latest secure firmware. Technical details, as well as the PoC and Citrix advisory, can be found in the articles linked below.