PT-2022-17806 · Microsoft+1 · Software Key Storage Provider+2

Published 2022-03-09 · Updated 2022-03-18 · CVE-2022-26355

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Citrix Federated Authentication Service (FAS) versions 7.17 through 10.6

Description The issue arises when Citrix Federated Authentication Service (FAS) is configured to store a registration authority certificate's private key in a Trusted Platform Module (TPM) using PowerShell. Instead of storing the key in the TPM, it is incorrectly stored in the Microsoft Software Key Storage Provider (MSKSP). This problem does not occur if the FAS administration console is used for configuration or if the TPM is not selected.

Recommendations For Citrix Federated Authentication Service (FAS) versions 7.17 through 10.6, as a temporary workaround, consider avoiding the use of PowerShell for configuring FAS to store the registration authority certificate's private key in the TPM. Instead, use the FAS administration console for configuration to prevent the private key from being stored in the Microsoft Software Key Storage Provider (MSKSP). At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2022-26355

Affected Products

Citrix Federated Authentication Service

Software Key Storage Provider

Powershell

References · 4

• https://osv.dev/vulnerability/CVE-2022-26355 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26355 · Security Note
• https://support.citrix.com/article/CTX341587 · Vendor Advisory
• https://t.me/cibsecurity/38712 · Telegram Post